| Description | This article describes a solution for an issue where SSL VPN users fail to establish a VPN connection using SAML authentication due to the 'Failed to verify signature' error. |
| Scope | When Azure AD is used as a SAML IdP for Authentication via FortiGate. |
| Solution |
The following errors are seen in the SAML debugs when the user attempts to connect to the VPN. diagnose debug application saml -1 954f-8326f1b10e00"><AuthnContext><AuthnContextClassRef>urn:oasis:names:tc: SAML:2.0:ac:classes:Password</AuthnContextClassRef></AuthnContext></AuthnStatement></Assertion></samlp:Response>
This is mostly due to a Certificate mismatch or a Corrupted Certificate that is imported from Azure AD.
When the Basic SAML Configuration, such as Entity ID, Reply URL, Sign-on URL, or Logout URL, is modified, the SAML Certificate needs to be downloaded and reinstalled in the Remote Certificate section of FortiGate, and then used in the SAML Configuration.
Find the screenshot below for reference on downloading the certificate:
To import the Certificate to FortiGate:
In GUI: Go to System -> Certificates -> Import -> Remote Certificate.
From CLI:
In the GUI, the certificate will be located under the 'Remote Certificate' section. The default name for an imported remote certificate is 'REMOTE_Cert_<number>'. To make it easier to distinguish from other certificates, it can be renamed in the CLI:
Example: rename REMOTE_Cert_1 to Azure_SAML:
Once the remote certificate is imported on the FortiGate, modify the idp-certificate under SAML configuration.
|
