Skip to main content
nihonsx5
nihonsx5
Visitor III
September 6, 2025
Question

Loop on SAML authentication page with Edge

  • September 6, 2025
  • 4 replies
  • 1058 views

Hello,

 

I am currently testing SAML authentication between FortiGate 7.4.8 and FortiAuthenticator 6.5.6 to allow users to access the internet. The user is running Windows 10 and is on the same VLAN as the FAC and FGT.

Authentication and redirection work perfectly with Firefox 142.0.1 or Chrome 140.0.7339.81. However, with Edge 140.0.3485.54, I get a loop between the FAC and the FGT.

 

Here is the configuration I use on FortiGate :

config user setting     set auth-type http https     set auth-cert "fgt.xxxxxxxxxx.xyz_2025"     set auth-ca-cert "proxy.xxxxxxxxxx.xyz"     set auth-timeout 30 end  config user saml     edit "fac_saml"         set entity-id "http://fgt.xxxxxxxxxx.xyz:1003/remote/saml/metadata/"         set single-sign-on-url "https://fgt.xxxxxxxxxx.xyz:1003/remote/saml/login"         set single-logout-url "https://fgt.xxxxxxxxxx.xyz:1003/remote/saml/logout"         set idp-entity-id "http://fac.xxxxxxxxxx.xyz/saml-idp/cc7z1kwrro2em2yu/metadata/"         set idp-single-sign-on-url "https://fac.xxxxxxxxxx.xyz/saml-idp/cc7z1kwrro2em2yu/login/"         set idp-single-logout-url "https://fac.xxxxxxxxxx.xyz/saml-idp/cc7z1kwrro2em2yu/logout/"         set idp-cert "fac_saml_idp"         set user-name "username"         set group-name "group"         set digest-method sha256     next end  config firewall auth-portal     set portal-addr "fgt.xxxxxxxxxx.xyz" end  config user group     edit "GS-WF-GOLD"         set member "fac_saml"         config match             edit 1                 set server-name "fac_saml"                 set group-name "CN=GS-WF-GOLD,OU=Web Filtering,DC=xxxxxxxxxx,DC=xyz"             next         end     next end

 

Here is debug saml with loop :

samld_process_request [145]: len=208, cmd=0, pid=158, job_id=576234 samld_process_request [162]: Received 208, 0x4ee8c0 __update_sp_sig_opt [256]: SP no sig is required. __samld_sp_create_auth_req [429]: SAML SP algo: 1 -> lasso=4. Binding Method: urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST  __samld_sp_create_auth_req [449]:  **** AuthnRequest URL **** https://fac.xxxxxxx.xyz/saml-idp/cc7z1kwrro2em2yu/login/?SAMLRequest=XXXXXXXX%3D&RelayState=magic%3D01000a86c9a8e8af *********************** __samld_sp_create_auth_req [463]:  **** AuthnRequest **** <samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="_FE7FCD4995F1A9B336DBB21383A82687" Version="2.0" IssueInstant="2025-09-03T22:14:02Z" Destination="https://fac.xxxxxxx.xyz/saml-idp/cc7z1kwrro2em2yu/login/" SignType="0" SignMethod="0" ForceAuthn="false" IsPassive="false" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" AssertionConsumerServiceURL="https://fgt.xxxxxxx.xyz:1003/remote/saml/login"><saml:Issuer>http://fgt.xxxxxxx.xyz:1003/remote/saml/metadata/</saml:Issuer><samlp:NameIDPolicy Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" AllowCreate="true"/></samlp:AuthnRequest> *********************** __samld_sp_create_auth_req [468]:  **** SP Login Dump **** <lasso:Login xmlns:lasso="http://www.entrouvert.org/namespaces/lasso/0.0" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" LoginDumpVersion="2"><lasso:Request><samlp:AuthnRequest ID="_FE7FCD4995F1A9B336DBB21383A82687" Version="2.0" IssueInstant="2025-09-03T22:14:02Z" Destination="https://fac.xxxxxxx.xyz/saml-idp/cc7z1kwrro2em2yu/login/" SignType="0" SignMethod="0" ForceAuthn="false" IsPassive="false" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" AssertionConsumerServiceURL="https://fgt.xxxxxxx.xyz:1003/remote/saml/login"><saml:Issuer>http://fgt.xxxxxxx.xyz:1003/remote/saml/metadata/</saml:Issuer><samlp:NameIDPolicy Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" AllowCreate="true"/></samlp:AuthnRequest></lasso:Request><lasso:RemoteProviderID>http://fac.xxxxxxx.xyz/saml-idp/cc7z1kwrro2em2yu/metadata/</lasso:RemoteProviderID><lasso:MsgUrl>https://fac.xxxxxxx.xyz/saml-idp/cc7z1kwrro2em2yu/login/?SAMLRequest=XXXXXXXX%3D&amp;RelayState=magic%3D01000a86c9a8e8af</lasso:MsgUrl><lasso:MsgRelayState>magic=01000a86c9a8e8af</lasso:MsgRelayState><lasso:HttpRequestMethod>4</lasso:HttpRequestMethod><lasso:RequestID>_FE7FCD4995F1A9B336DBB21383A82687</lasso:RequestID></lasso:Login> *********************** samld_send_common_reply [91]: Code: 0, id: 576234, pid: 158, len: 2444, data_len 2428 samld_send_common_reply [99]:     Attr: 14, 1789, <lasso:Login xmlns:lasso="http://www.entrouvert.org/namespaces/lasso/0.0" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" LoginDumpVersion="2"><lasso:Request><samlp:AuthnRequest ID="_FE7FCD4995F1A9B336DBB21383A82687" Version="2.0" IssueInstant="2025-09-03T22:14:02Z" Destination="https://fac.xxxxxxx.xyz/saml-idp/cc7z1kwrro2em2yu/login/" SignType="0" SignMethod="0" ForceAuthn="false" IsPassive="false" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" AssertionConsumerServiceURL="https://fgt.xxxxxxx.xyz:1003/remote/saml/login"><saml:Issuer>http://fgt.xxxxxxx.xyz:1003/remote/saml/metadata/</saml:Issuer><samlp:NameIDPolicy Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" AllowCreate="true"/></samlp:AuthnRequest></lasso:Request><lasso:RemoteProviderID>http://fac.xxxxxxx.xyz/saml-idp/cc7z1kwrro2em2yu/metadata/</lasso:RemoteProviderID><lasso:MsgUrl>https://fac.xxxxxxx.xyz/saml-idp/cc7z1kwrro2em2yu/login/?SAMLRequest=XXXXXXXX%3D&amp;RelayState=magic%3D01000a86c9a8e8af</lasso:MsgUrl><lasso:MsgRelayState>magic=01000a86c9a8e8af</lasso:MsgRelayState><lasso:HttpRequestMethod>4</lasso:HttpRequestMethod><lasso:RequestID>_FE7FCD4995F1A9B336DBB21383A82687</lasso:RequestID></lasso:Login> samld_send_common_reply [99]:     Attr: 11, 639, https://fac.xxxxxxx.xyz/saml-idp/cc7z1kwrro2em2yu/login/?SAMLRequest=XXXXXXXX%3D&RelayState=magic%3D01000a86c9a8e8af samld_send_common_reply [119]: Sent resp: 2444, pid=158, job_id=576234. samld_process_request [145]: len=208, cmd=0, pid=158, job_id=576234 samld_process_request [162]: Received 208, 0x4ee8c0 __update_sp_sig_opt [256]: SP no sig is required. __samld_sp_create_auth_req [429]: SAML SP algo: 1 -> lasso=4. Binding Method: urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST  __samld_sp_create_auth_req [449]:  **** AuthnRequest URL **** https://fac.xxxxxxx.xyz/saml-idp/cc7z1kwrro2em2yu/login/?SAMLRequest=XXXXXXXX%3D%3D&RelayState=magic%3D01000a86c9a8e8af *********************** __samld_sp_create_auth_req [463]:  **** AuthnRequest **** <samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="_12933AB4937D80D06AEECC206D213CDE" Version="2.0" IssueInstant="2025-09-03T22:14:13Z" Destination="https://fac.xxxxxxx.xyz/saml-idp/cc7z1kwrro2em2yu/login/" SignType="0" SignMethod="0" ForceAuthn="false" IsPassive="false" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" AssertionConsumerServiceURL="https://fgt.xxxxxxx.xyz:1003/remote/saml/login"><saml:Issuer>http://fgt.xxxxxxx.xyz:1003/remote/saml/metadata/</saml:Issuer><samlp:NameIDPolicy Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" AllowCreate="true"/></samlp:AuthnRequest> *********************** __samld_sp_create_auth_req [468]:  **** SP Login Dump **** <lasso:Login xmlns:lasso="http://www.entrouvert.org/namespaces/lasso/0.0" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" LoginDumpVersion="2"><lasso:Request><samlp:AuthnRequest ID="_12933AB4937D80D06AEECC206D213CDE" Version="2.0" IssueInstant="2025-09-03T22:14:13Z" Destination="https://fac.xxxxxxx.xyz/saml-idp/cc7z1kwrro2em2yu/login/" SignType="0" SignMethod="0" ForceAuthn="false" IsPassive="false" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" AssertionConsumerServiceURL="https://fgt.xxxxxxx.xyz:1003/remote/saml/login"><saml:Issuer>http://fgt.xxxxxxx.xyz:1003/remote/saml/metadata/</saml:Issuer><samlp:NameIDPolicy Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" AllowCreate="true"/></samlp:AuthnRequest></lasso:Request><lasso:RemoteProviderID>http://fac.xxxxxxx.xyz/saml-idp/cc7z1kwrro2em2yu/metadata/</lasso:RemoteProviderID><lasso:MsgUrl>https://fac.xxxxxxx.xyz/saml-idp/cc7z1kwrro2em2yu/login/?SAMLRequest=XXXXXXXX%3D%3D&amp;RelayState=magic%3D01000a86c9a8e8af</lasso:MsgUrl><lasso:MsgRelayState>magic=01000a86c9a8e8af</lasso:MsgRelayState><lasso:HttpRequestMethod>4</lasso:HttpRequestMethod><lasso:RequestID>_12933AB4937D80D06AEECC206D213CDE</lasso:RequestID></lasso:Login> *********************** samld_send_common_reply [91]: Code: 0, id: 576234, pid: 158, len: 2448, data_len 2432 samld_send_common_reply [99]:     Attr: 14, 1791, <lasso:Login xmlns:lasso="http://www.entrouvert.org/namespaces/lasso/0.0" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" LoginDumpVersion="2"><lasso:Request><samlp:AuthnRequest ID="_12933AB4937D80D06AEECC206D213CDE" Version="2.0" IssueInstant="2025-09-03T22:14:13Z" Destination="https://fac.xxxxxxx.xyz/saml-idp/cc7z1kwrro2em2yu/login/" SignType="0" SignMethod="0" ForceAuthn="false" IsPassive="false" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" AssertionConsumerServiceURL="https://fgt.xxxxxxx.xyz:1003/remote/saml/login"><saml:Issuer>http://fgt.xxxxxxx.xyz:1003/remote/saml/metadata/</saml:Issuer><samlp:NameIDPolicy Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" AllowCreate="true"/></samlp:AuthnRequest></lasso:Request><lasso:RemoteProviderID>http://fac.xxxxxxx.xyz/saml-idp/cc7z1kwrro2em2yu/metadata/</lasso:RemoteProviderID><lasso:MsgUrl>https://fac.xxxxxxx.xyz/saml-idp/cc7z1kwrro2em2yu/login/?SAMLRequest=XXXXXXXX%3D%3D&amp;RelayState=magic%3D01000a86c9a8e8af</lasso:MsgUrl><lasso:MsgRelayState>magic=01000a86c9a8e8af</lasso:MsgRelayState><lasso:HttpRequestMethod>4</lasso:HttpRequestMethod><lasso:RequestID>_12933AB4937D80D06AEECC206D213CDE</lasso:RequestID></lasso:Login> samld_send_common_reply [99]:     Attr: 11, 641, https://fac.xxxxxxx.xyz/saml-idp/cc7z1kwrro2em2yu/login/?SAMLRequest=XXXXXXXX%3D%3D&RelayState=magic%3D01000a86c9a8e8af samld_send_common_reply [119]: Sent resp: 2448, pid=158, job_id=576234. samld_process_request [145]: len=208, cmd=0, pid=158, job_id=576234 samld_process_request [162]: Received 208, 0x4ee8c0 __update_sp_sig_opt [256]: SP no sig is required. __samld_sp_create_auth_req [429]: SAML SP algo: 1 -> lasso=4. Binding Method: urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST  __samld_sp_create_auth_req [449]:  **** AuthnRequest URL **** https://fac.xxxxxxx.xyz/saml-idp/cc7z1kwrro2em2yu/login/?SAMLRequest=XXXXXXXX&RelayState=magic%3D01000a86c9a8e8af *********************** __samld_sp_create_auth_req [463]:  **** AuthnRequest **** <samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="_7D51433E3C8CF9902EC928C5D82CE836" Version="2.0" IssueInstant="2025-09-03T22:14:13Z" Destination="https://fac.xxxxxxx.xyz/saml-idp/cc7z1kwrro2em2yu/login/" SignType="0" SignMethod="0" ForceAuthn="false" IsPassive="false" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" AssertionConsumerServiceURL="https://fgt.xxxxxxx.xyz:1003/remote/saml/login"><saml:Issuer>http://fgt.xxxxxxx.xyz:1003/remote/saml/metadata/</saml:Issuer><samlp:NameIDPolicy Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" AllowCreate="true"/></samlp:AuthnRequest> *********************** __samld_sp_create_auth_req [468]:  **** SP Login Dump **** <lasso:Login xmlns:lasso="http://www.entrouvert.org/namespaces/lasso/0.0" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" LoginDumpVersion="2"><lasso:Request><samlp:AuthnRequest ID="_7D51433E3C8CF9902EC928C5D82CE836" Version="2.0" IssueInstant="2025-09-03T22:14:13Z" Destination="https://fac.xxxxxxx.xyz/saml-idp/cc7z1kwrro2em2yu/login/" SignType="0" SignMethod="0" ForceAuthn="false" IsPassive="false" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" AssertionConsumerServiceURL="https://fgt.xxxxxxx.xyz:1003/remote/saml/login"><saml:Issuer>http://fgt.xxxxxxx.xyz:1003/remote/saml/metadata/</saml:Issuer><samlp:NameIDPolicy Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" AllowCreate="true"/></samlp:AuthnRequest></lasso:Request><lasso:RemoteProviderID>http://fac.xxxxxxx.xyz/saml-idp/cc7z1kwrro2em2yu/metadata/</lasso:RemoteProviderID><lasso:MsgUrl>https://fac.xxxxxxx.xyz/saml-idp/cc7z1kwrro2em2yu/login/?SAMLRequest=XXXXXXXX&amp;RelayState=magic%3D01000a86c9a8e8af</lasso:MsgUrl><lasso:MsgRelayState>magic=01000a86c9a8e8af</lasso:MsgRelayState><lasso:HttpRequestMethod>4</lasso:HttpRequestMethod><lasso:RequestID>_7D51433E3C8CF9902EC928C5D82CE836</lasso:RequestID></lasso:Login> *********************** samld_send_common_reply [91]: Code: 0, id: 576234, pid: 158, len: 2468, data_len 2452 samld_send_common_reply [99]:     Attr: 14, 1801, <lasso:Login xmlns:lasso="http://www.entrouvert.org/namespaces/lasso/0.0" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" LoginDumpVersion="2"><lasso:Request><samlp:AuthnRequest ID="_7D51433E3C8CF9902EC928C5D82CE836" Version="2.0" IssueInstant="2025-09-03T22:14:13Z" Destination="https://fac.xxxxxxx.xyz/saml-idp/cc7z1kwrro2em2yu/login/" SignType="0" SignMethod="0" ForceAuthn="false" IsPassive="false" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" AssertionConsumerServiceURL="https://fgt.xxxxxxx.xyz:1003/remote/saml/login"><saml:Issuer>http://fgt.xxxxxxx.xyz:1003/remote/saml/metadata/</saml:Issuer><samlp:NameIDPolicy Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" AllowCreate="true"/></samlp:AuthnRequest></lasso:Request><lasso:RemoteProviderID>http://fac.xxxxxxx.xyz/saml-idp/cc7z1kwrro2em2yu/metadata/</lasso:RemoteProviderID><lasso:MsgUrl>https://fac.xxxxxxx.xyz/saml-idp/cc7z1kwrro2em2yu/login/?SAMLRequest=XXXXXXXX&amp;RelayState=magic%3D01000a86c9a8e8af</lasso:MsgUrl><lasso:MsgRelayState>magic=01000a86c9a8e8af</lasso:MsgRelayState><lasso:HttpRequestMethod>4</lasso:HttpRequestMethod><lasso:RequestID>_7D51433E3C8CF9902EC928C5D82CE836</lasso:RequestID></lasso:Login> samld_send_common_reply [99]:     Attr: 11, 651, https://fac.xxxxxxx.xyz/saml-idp/cc7z1kwrro2em2yu/login/?SAMLRequest=XXXXXXXX&RelayState=magic%3D01000a86c9a8e8af samld_send_common_reply [119]: Sent resp: 2468, pid=158, job_id=576234. samld_process_request [145]: len=208, cmd=0, pid=158, job_id=576234 samld_process_request [162]: Received 208, 0x4ee8c0 __update_sp_sig_opt [256]: SP no sig is required. __samld_sp_create_auth_req [429]: SAML SP algo: 1 -> lasso=4. Binding Method: urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST  __samld_sp_create_auth_req [449]:

 

The certificates (root and intermediate) are correctly installed on the computer. I imagine there is a setting to change on Edge. But I haven't found it yet.

4 replies

Jean-Philippe_P
Staff & Editor
Jean-Philippe_P
Staff & Editor
September 9, 2025

Hello nhonsx5, 

 

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible. 

 

Thanks, 

Jean-Philippe - Fortinet Community Team
    Jean-Philippe_P
    Staff & Editor
    Jean-Philippe_P
    Staff & Editor
    September 11, 2025

    Hello,

     

    We are still looking for an answer to your question.

     

    We will come back to you ASAP.

     

    Thanks,

    Jean-Philippe - Fortinet Community Team
    Jean-Philippe_P
    Staff & Editor
    Jean-Philippe_P
    Staff & Editor
    September 12, 2025

    Hello nihonsx5,

     

    I found this solution. Can you tell us if it helps, please?

     

    The issue you're experiencing with Microsoft Edge could be related to how the browser handles SAML authentication or specific security settings. Here are some steps you can take to troubleshoot and potentially resolve the issue:

     

    1. Clear Browser Cache and Cookies: Clear the cache and cookies in Microsoft Edge to ensure no stale sessions or cached data are causing the loop.

    2. Check Security Settings: Ensure that Edge is not blocking third-party cookies, as this can interfere with SAML authentication. Go to `Settings > Cookies and site permissions > Manage and delete cookies and site data` and ensure that third-party cookies are allowed.

    3. Disable Extensions: Temporarily disable any browser extensions that might interfere with the authentication process, such as ad blockers or privacy tools.

    4. Check Certificate Trust: Verify that the root and intermediate certificates are correctly installed and trusted by Edge. You can check this in `Settings > Privacy, search, and services > Manage certificates`.

    5. Compatibility Mode: Try running Edge in compatibility mode for older versions of Internet Explorer, if applicable, to see if it resolves the issue.

    6. Update Edge: Ensure that Microsoft Edge is updated to the latest version, as updates may include fixes for known issues.

    7. Review SAML Configuration: Double-check the SAML configuration on both FortiGate and FortiAuthenticator to ensure there are no discrepancies or misconfigurations.

    8. Network Logs: Review network logs and SAML debug logs for any errors or warnings that might provide more insight into the issue.

     

    If the issue persists after trying these steps, consider reaching out to Microsoft support for further assistance, as the problem may be specific to the Edge browser's handling of SAML authentication.

    Jean-Philippe - Fortinet Community Team
    nihonsx5
    nihonsx5Author
    Visitor III
    September 15, 2025

    Thank you Jean-Philippe.

     

    Edge launches automatically, checking msftconnecttest.com by default and then (try to) loading other sites. I changed the default page (https://4[.]ident[.]me) and added this site to Internet Explorer compatibility mode.

     

    If I launch a new tab, it works after authentication. If Edge launches automatically, it doesn't work, even when setting msftconnecttest[.]com to compatibility mode.

     

    I checked the CA certificates, SAML configuration, cookies (SameSite: None, Secure), etc., but it still doesn't work. In the logs, instead of returning an HTTP 303 code like Firefox/Chrome, Edge returns a 200 and it loops.

     

    I don't understand why Edge is so difficult to operate.

    Terms & ConditionsAccessibility statement