Troubleshooting Tip: FortiClient SAML authentication when SSL VPN web mode is disabled globally

[pmanak]

Description	This article describes the behavior of FortiClient SAML authentication when SSLVPN web mode is disabled globally.
Scope	FortiGate
Solution	Starting on FortiOS 7.4.1, a global command has been provided to disable sslvpn-web-mode globally, which will prevent sslvpn-web-mode configuration in all SSLVPN portals. config system global     set sslvpn-web-mode disable end For further information to disable sslvpn-web-mode, refer to this article.   When sslvpn-web-mode is disabled under global setting and SAML authentication is enabled, the FortiClient internal browser gives a 403 forbidden error for SAML authentication. This behavior is not expected and has been resolved in firmware 7.6.1. To work around this issue, select 'Use external browser as user-agent for SAML user authentication' in FortiClient settings.