SAML Issue

Forum|Forum|3 years ago
February 2, 2023
6 replies
21810 views

Hi all,

So I am trying to setup Azure Saml for the first time and I am hitting an issue that I cannot seem to find an answer to. So when using the forticlient I can get to show the microsoft login page but after I enter the user/password I get this.

AADSTS700016: Application with identifier '' was not found in the directory ''. This can happen if the application has not been installed by the administrator of the tenant or consented to by any user in the tenant. You may have sent your authentication request to the wrong tenant.

Everything I can find seems to point to the making sure the Azure Application Identifier (Entity ID) and the fortigate Entity-ID match but I have verified it and they do match so not sure what else to look at.

Eddie

FortiGate

jhussain_FTNT

Staff

Hi,

The error seams to relate to The issuer attribute sent from the application to Azure AD in the SAML request doesn’t match the Identifier value that's configured for the application in Azure AD.Kindly refer the below document.

https://learn.microsoft.com/en-us/troubleshoot/azure/active-directory/error-code-aadsts70001-app-not-found-in-directory

Kindly refer the below document to configure Fortigate with Azure SAML

https://learn.microsoft.com/en-us/azure/active-directory/saas-apps/fortigate-ssl-vpn-tutorial

https://docs.fortinet.com/document/fortigate-public-cloud/7.2.0/azure-administration-guide/584456/configuring-saml-sso-login-for-ssl-vpn-with-azure-ad-acting-as-saml-idp

Regards

Jamal

pminarik

Staff

You're on the right track. This means that the entity ID of the Service Provider (FortiGate) doesn't match on both sides, or possibly doesn't even exist in Azure at all.

On the FortiGate-side, this is the value in the "entity-id" option.

On Azure-side, this is "Identifier (Entity ID)".

This, and some other possible errors, has some commentary in the following KB article:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuring-SAML-SSO-login-for-FortiGate/ta-p/194656

Note: While the guide focuses on SAML for admin login, the Azure-side error messages are the same even if you use it for SSL-VPN or captive portal.