Troubleshooting Tip: How to troubleshoot the error 'do_http_validate:440 method (POST) on uri ... not allowed' when connecting to SSL VPN using SAML credentials

enguyen3467 · ‎12-10-2024

Description

This article describes the solution to troubleshoot the error 'do_http_validate:440 method (POST) on uri ... not allowed' when trying to connect to the SSL VPN tunnel using a SAML credential.

Scope

FortiGate, FortiClient.

Solution

Upon connecting to the SSL VPN tunnel using SAML, this error message can be encountered before reaching to the SAML login page:

When enabling the SAML and SSL VPN debug on the FortiGate with the following commands:

diagnose debug reset

diagnose vpn ssl debug-filter src-addr4 x.x.x.x <--- x.x.x.x = endpoint's public IP.

diagnose debug application sslvpn -1

diagnose debug application saml -1

diagnose debug enable

The following debug message can be seen:

[31038:root:62][fsv_found_saml_server_name_from_auth_lst:128] Found SAML server [FAC_SAML] in group [Test-group]
[31038:root:62]saml login [31038:98] SAML_INFO: Found server 'FAC_SAML' in group 'Test-group'
[31038:root:62]saml login 98 login request
[31038:root:62]saml login 98 metadata: /dev/cmdb/.hidden/sslvpn/tmp/0-FAC_SAML-sp-meta.xml
[31038:root:62]saml login 98 sp pkey:
[31038:root:62]saml login 98 idp metadata: /dev/cmdb/.hidden/sslvpn/tmp/0-FAC_SAML-idp-meta.xml
[31038:root:62]saml login 98 idp entity: http://10.9.10.235/saml-idp/fgtsp/metadata/
[31038:root:61]do_http_validate:440 method (POST) on uri (/test/remote/saml/login) not allowed. <------
[31038:root:61]sslConnGotoNextState:318 error (last state: 1, closeOp: 0)
[31038:root:61]Destroy sconn 0x7f8b6c01e000, connSize=2. (root)
[31038:root:61]SSL state:warning close notify (10.9.10.144)

This error is most likely due to the inclusion of the SSL VPN realm portion in the SP's URLs during the SAML configuration. By design, the SSL VPN realm will not be called in the SAML exchange. For example, here is the SAML configuration on the FortiGate:

config user saml

edit "FAC_SAML"

set entity-id "http://10.9.11.6:44343/test/remote/saml/metadata/"

set single-sign-on-url "https://10.9.11.6:44343/test/remote/saml/login"

set single-logout-url "https://10.9.11.6:44343/test/remote/saml/logout"

set idp-entity-id "http://10.9.10.235/saml-idp/fgtsp/metadata/"

set idp-single-sign-on-url "https://10.9.10.235/saml-idp/fgtsp/login/"

set idp-single-logout-url "https://10.9.10.235/saml-idp/fgtsp/logout/"

set idp-cert "REMOTE_Cert_1"

set user-name "username"

set group-name "group"

set digest-method sha1

Be sure to remove the portion in red in the SAML configuration on both the SP and IdP sides. Realm is only used to connect to different SSL VPN portals, it does not have anything to do with the SAML configuration.