Skip to main content
perklit
perklit
New Member
April 21, 2023
Question

SSL VPN - Azure conditional access - sign-in frequency ignored - forticlient 7.0.8.0427

  • April 21, 2023
  • 7 replies
  • 8206 views

We are using Forticlient SAML login with Azure AD.

When logging in, the users enters mail address, password and MFA, and it all works.

However, we have setup the conditional access with a 'Sign-in frequency' of 7 days, but the user is prompted for login every time.

We set it up using the client v7.0.7, and it worked perfectly, but after v7.0.8 we get prompted every time. 

If we change the tunnel settings to 'Use External Browser as User-agent for SAML Login', a browser tab is opened and then it works - only the first time the user is prompted for login. Any consecutive logins is done automatic (this is not ideal to use permanently as it looks weird with the open browser tab).

So to sum up, is seems that from v7.0.7 to 7.0.8 the Forticlient built in prompt doesn't save your credentials.

 

Any suggestions, 

Thanks in advance, Per.

    7 replies

    pfournier
    pfournier
    Explorer III
    April 21, 2023

    Having the same issue here, its asking for credentials every single time. 

    dips
    dips
    New Member
    April 21, 2023

    Same here, encountering the exact same issue. 

    perklit
    perklitAuthor
    New Member
    April 26, 2023

    Info: response from Fortinet. It's a known bug (BUGID 0835436). I will update when I know more.

      Arxada_Corp
      Arxada_Corp
      New Member
      June 30, 2023

      Any updates on this from Fortinet?

      perklit
      perklitAuthor
      New Member
      July 3, 2023

      No update from Fortinet. They can't (or won't) say when they might be looking at it, whether it will be in a patch release, or if it might be resolved in v7.2.

      So a bit disappointing...

      rockhead006
      rockhead006
      Visitor III
      July 10, 2023

      This was recommended by Fortinet Support for me, and it seemed to have worked:

       

      In the Remote Access VPN profile:

      Enable the "Show Remember Password" checkbox.

       

      In the System profile,

      Please, try setting the tag in the XML profile config to '1' and retest.

      <system>

      <ui>

      ...

      <dont_modify_cookies>1</dont_modify_cookies>

      </ui>

        pfournier
        pfournier
        Explorer III
        July 11, 2023

        Just to clarify this will store the password permanently though, not cache recent credentials? I want it to prompt again if its not used for say a week or so, I don't want their password stored permanently. 

        rockhead006
        rockhead006
        Visitor III
        July 11, 2023

        It depends on your Azure settings for reauthentication/session timeout (it may be under the Conditional Access policies). We have it set to timeout authentication after 1 hour. So if we disconnect and reconnect a VPN after 1 hour it will prompt for MFA again.

        perklit
        perklitAuthor
        New Member
        July 11, 2023

        I can confirm, that the solution described by rockhead006 seems to work for us as well.

        Still strange then though, that when reported to Fortinet they responded that it was a known bug, and that they haven't returned to me with this 'workaround'. Oh well... 

        Terms & ConditionsCookie settingsAccessibility statement