Skip to main content
Duchwwo
Duchwwo
Visitor III
December 20, 2024
Question

SAML is not working with WPA2

  • December 20, 2024
  • 4 replies
  • 1928 views

Hi, i have followed the configuration guide from the below link Configure SAML SSO for WiFi SSID over Cap... - Fortinet Community, and the authentication works well, within the default settings. However, since the captive portal user traffic is not encrypted, I decided to switch to WPA2 with PSK and captive portal. After this change, users receive an IP address (after providing the PSK), but the auth process doesn't occur, SAML auth request is not showing during the debug, and users see a "site cannot be reached" error when trying to access any website. Is it possible to configure SAML SSO but with any level of user traffic encryption? Fortigate 61f - soft 7.2.9

4 replies

kaman
Staff
kaman
Staff
December 20, 2024

Hi Duchwwo,

Try to increase the remote authentication timeout:

 

config system global

    set remoteauthtimeout 60

end


Also, can you please attach the SAML logs here to check further:

diag debug console timestamp enable

diag debug app samld -1
diag debug enable

    Duchwwo
    DuchwwoAuthor
    Visitor III
    December 24, 2024

    Hi kaman, I had these settings applied previously. However, after recreating the ssid from scratch, I managed to complete the authentication process for Windows users. For macOS, saml is working only without WPA2. After enabling encryptionm safari displays the following: shared image.jpg

    image (6).jpg

    Fortigate certificate has been delivered to macOS and its trusted, captive.apple.com has also been exempt from captive portal. From saml debug logs i can see that the request has been sent, but without reply. I will share the SAML logs after the holidays.

    Sheikh
    Staff
    Sheikh
    Staff
    December 24, 2024

    Hrllo @Duchwwo,

     

    1. Please try to download .HAR file (Developer tool) from browser when replicating the issue, that might give some clue.

     

    2. You can also install SAML Tracer extension and then check again.

     

    regards,

     

    Sheikh

    If you have found a solution, please like and mark it as solved to make it easily accessible for everyone.
      Duchwwo
      DuchwwoAuthor
      Visitor III
      January 3, 2025

      Hi, thx for the diagnosic the diagnostic tips. After reviewing the HAR file, I discovered that for Firefox and MacOs "detectportal.firefox.com" needs to be whitelisted. Unfortunately, the issue with Safari is still under investigation, but it appears to be related to an SSL certificate error.

       

      Duchwwo
      DuchwwoAuthor
      Visitor III
      January 8, 2025

      The issue with Safari has been resolved because the cache saved in the browser was causing some unexpected problems. After doing the packet capture and analyzing it, I noticed that there was no traffic being sent to login.microsoft. By performing basic troubleshooting, including clearing safari's cache, the authentication process started, and everything is functioning pretty well right now. However, I still encounter an error with SSL certificate (for all browsers). The error indicates either that the certificate's domain name doesn't match (err_cert_authority_invalid), i suppose that its related to Fortinet_factory certificate being thrown when redirect to login.microsoft.com is in place. The certificate has been added to cert store and installed on browsers - without success. 

      Terms & ConditionsAccessibility statement