FWB, SAML and Credential Stuffing

When SAML authentication is used, FortiWeb doesn’t actually see the user’s credentials, since authentication happens directly between the client and the Identity Provider (IdP). Because of that, FortiWeb can’t apply its usual credential-stuffing protections in that flow. If you enable Site Publish, FortiWeb becomes part of the authentication path.

It can then analyze login attempts, detect repeated credential reuse, and apply rate-limiting or CAPTCHA before sending credentials to the IdP. That’s the only case where its credential-stuffing protection applies. When SAML is configured directly between the client and the protected server, the login process bypasses FortiWeb’s controls, so credential-stuffing detection won’t work in that setup.

To prevent such attacks in that case, you’d need to rely on the IdP’s own protections or additional WAF rules focusing on abnormal request patterns.