Troubleshooting Tip: Admin authentication with SAML SSO breaks after upgrade to firmware 7.4.1

dbu · ‎10-15-2023

Description

This article describes how to fix the admin authentication with SAML SSO if it breaks when upgrading to firmware v7.4.1.

Scope

FortiGate v7.4.1.

Solution

This is known as issue 949699.
See the known issues section for this release in its release notes.
Admin Single Sign-on with SAML breaks after upgrading to firmware 7.4.1 because the entity ID is set to empty.

Error received:

Sorry, but we’re having trouble signing you in.

AADSTS7500525: There was an XML error in the SAML message at line 1, position 504. Verify that the XML content of the SAML messages conforms to the SAML protocol specifications.

Troubleshooting details:
When contacting the administrator, send the following info:

Copy info to the clipboard:

Request Id: d5b05590-c9e5-4697-8ed0-499e0bec0800
Correlation Id: 451145ce-9cdd-4235-9f74-5810d1d8963e
Timestamp: 2023-10-03T03:13:16Z
Message: AADSTS7500525: There was an XML error in the SAML message at line 1, position 504. Verify that the XML content of the SAML messages conforms to the SAML protocol specifications.

Workaround:

In order to fix the issue, manually configure the entity ID as it was configured before the upgrade:

From the CLI:

config system saml

set entity-id <SP entity ID>

end

From the GUI:
Select Security Fabric -> Fabric connectors -> Security Fabric Setup -> Edit -> Single Sign-On Settings.

MicrosoftTeams-image (28).png