Skip to main content
leo-ehk
leo-ehk
New Member
November 16, 2023
Solved

SAML Configuration for Fortigate SSL VPN SSO - Invalid HTTP request.

  • November 16, 2023
  • 3 replies
  • 19672 views

Hello community,

 

we would like to configure our fortigate 100F SSLVPN Access with SAML and MS Entra.

Unfortunately, we get the following prompt 

 

SAML-FortiIssue.PNG

We use the following MS Node:

https://learn.microsoft.com/en-us/entra/identity/saas-apps/fortigate-ssl-vpn-tutorial

Is it important, that we use a entra Plan or is the free Version okay? We use M365 business St. 

Best answer by pminarik

SAML authentication can be configured to work without specific groups. In this situation, you'd better manually set who can use the "enterprise application" (SSL-VPN) in Azure AD/Entra's configuration.

 

The P1/P2 plan affects what additional options you have available, but a basic SAML setup can be run even with a free plan, as far as I am aware.

3 replies

pminarik
Staff
pminarik
Staff
November 16, 2023

The /remote/saml/login URL is not intended to be directly accessed by a user, as it expects to receive some atttributes, automatically generated by the SP/IdP.

 

You should simply try connecting to the bare URL , such as: https://myvpn.com:<port> . From there, you should either be automatically redirected to the IdP's login page (if using exclusively SAML for VPN authentication), or offered a chance to enter credentials or click a button to initiate the SAML process (=redirects to the IdP to authenticate). 

    leo-ehk
    leo-ehkAuthor
    New Member
    November 16, 2023

    Hello pminarik,

     

    thanks for your fast answer. I get the same problem on the FortiClient.

    SAML-FortiIssue2.PNG

     

    pminarik
    Staff
    pminarik
    Staff
    November 16, 2023

    Can you share the configuration of the VPN profile on the FortiClient? (you can hide the IP or domain name, but leave everything else visible, including any /url/paths/used ).

    On top of that, it would be useful to review the SAML config on the FortiGate, for which you can share the output of "show user saml". (again feel free to hide the domain names and IPs).

      sbaltic
      sbaltic
      New Member
      December 3, 2023

      Hello. 

      this is my config on FG and Entra ID and is not working ... invalid HTTP request

      Screenshot 2023-12-03 at 8.31.05 AM.png

       

      Screenshot 2023-12-03 at 8.25.37 AM.png

      pminarik
      Staff
      pminarik
      Staff
      December 5, 2023

      I would start by removing the ":443" part from all URLs on all sides. That's the default port for HTTPS, so explicitly including it like that is weird. Could be a cause of some issues.

       

      You should also most likely remove the "set cert" part in the FGT config. That is used for signing requests sent by the FortiGate, and by default AzureAD/Entra doesn't ask for this. (nor do I see any indication in your screenshots that you've manually enabled requiring SP requests to be signed)

      sbaltic
      sbaltic
      New Member
      December 5, 2023

      I removed set cert and removed 443, but still got error "Invalid HTTP request"

      Wimukthi_Bandara
      Wimukthi_Bandara
      New Member
      September 24, 2024

      i also face same issue and change this value image.png

      pminarik
      Staff
      pminarik
      Staff
      September 24, 2024

      At a glance the settings look okay, but to fully judge this, we'd need to see the FortiGate configuration as well, samld+sslvpn debugs, and also the exact description of the unexpected behavior/errors you're observing.

        Terms & ConditionsAccessibility statement