Fortinet Single Sign On (FSSO) for SSL-VPN SAML Entra via Syslog

Hello,
has anyone used SSL VPN with Microsoft Entra SAML authentication and forwarding of login / logout info to FSSO via syslog? In SAML we use the mail address of the user as UPN.

We want to use the concept to run the authentication of the firewall rules via FSSO Active Directory groups.

Background is the following article: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configure-Fortinet-Single-Sign-On-FSSO-for-SSL-VPN/ta-p/229274?searchString=&from=0&sortby=_score&orderBy=desc&pageNo=1&aggregations=%5B%5D&uid=8021d0dd-1517-11ec-b3e2-0242ac12000d&resultsPerPage=10&exactPhrase=&withOneOrMore=&withoutTheWords=&pageSize=10&language=en&state=1&suCaseCreate=false

My problem is that although the syslog message arrives in the FSSO, no query is then sent to the LDAP with the UPN.

Fortigate 600F with 7.4.3

config log syslogd setting     set status enable     set server "10.7.1.67" end  config log syslogd filter     set forward-traffic disable     set local-traffic disable     set multicast-traffic disable     set sniffer-traffic disable     set ztna-traffic disable     set anomaly disable     set voip disable     config free-style         edit 1             set category event             set filter "((logid 0101039947) or (logid 0101039948) or (logid 0101039949))"         next     end en

FSSO logon_event.log

02/15/2024 16:56:23	[RECV_EVENT_FROM_DC]	packet_len:92 dcagent_ip:10.5.1.2 time:1708012583 data_len:49 data:10.199.1.10/SYSLOG/Tobias.Berndes@inotec-licht.de ip:0.0.0.0

Wireshark Syslog + LDAP Request