|
FortiGate had configured SAML login using the OKTA SAML identity provider, but failed to connect.
Run the 'diagnose debug application samld -1 ' command, and it shows the error below:
diagnose debug application samld -1
__samld_sp_login_resp [871]: Audience is invalid!
samld_send_common_reply [114]: Code: 6, id: 1168, data_len: 43
samld_send_common_reply [122]: Attr: 22, 8, ÿÿ
samld_send_common_reply [122]: Attr: 23, 21, Undefined error.
'Audience is invalid' indicates that the FortiGate Service Provider Information 'entity-id ' under the user's SAML is configured differently from the Okta settings.
The Audience URL, also known as Audience Restriction, specifies the intended recipient of the SAML Assertion. This field might be referred to as the 'Entity ID' by different vendors. While it can be any string, it is usually formatted as a URL, often including the Service Provider’s (SP’s) name. Frequently, the Audience URI matches the Assertion Consumer Service (ACS) URL, also known as the SSO URL. A common cause of the 'Audience is invalid' error is typos in the SP Entity ID, particularly with 'https://' and 'http://'.
Re-check that the URL in FortiGate is configured the same as the Okta settings.
On Okta's SAML configuration, it is possible to find Entity-ID settings under SAML Configuration -> General -> Audience URI (SP Entity ID).
The Audience URI string is case-sensitive. For example, the following two URIs are for different audiences and will generate an 'Audience is invalid' error:
FortiGate: set entity-id "https://WOOD.example.com:12345/remote/saml/metadata/"
Okta SP Entity ID: https://wood.example.com:12345/remote/saml/metadata/
To trace the SAML Authentication, refer to this article: Technical Tip: How to record a client SAML trace and examine the SAML response:
__samld_sp_login_resp [854]: Audience is invalid!
samld_send_common_reply [91]: Code: 7, id: 362199, pid: 246, len: 53, data_len 37
If SAML responds with code 7 along with 'Audience is invalid!' in the debug output, there is a configuration mismatch: the username claimed on FortiGate must be the same as on the SAML server. The Audience value must exactly match one of the service principal names on the Server.
config user saml
edit "OKTA"
set user-name <claim-name> <----- This must be the same as the username configured on SAML.
next
end
Related articles:
|
