Troubleshooting Tip: How to fix SAML error 403 'access to this resource via HTTP is not allowed'

[kiri]

Description	This article describes a potential fix for FortiAuthenticator SAML IDP error 403. The same event produces the following error: 'Access Denied, access to this resource via HTTP is not allowed with the current network interface configuration. Please check your network interface configuration'.
Scope	FortiAuthenticator v6.6.0, v6.5.4.
Solution	Make sure that: The required services (HTTP, HTTPS, SAML IdP) are enabled on the service interface. The SAML SP is using the FortiAuthenticator FQDN configured in Authentication, SAML IDP, General, and IdP-initiated login URL. The server address is the same as Device FQDN. If the server address is not the same as the Device FQDN and it cannot be changed, add the server address to the GUI under Admin -> System access: 'Additional allowed hosts/domain names'. Note: This does not apply for 6.6.1+ and 6.5.5+.