Troubleshooting Tip: Troubleshooting SAML Issues in FortiSASE

[ihaidar]

Description	This article explains the methodology for troubleshooting SAML issues while connecting to the SSL VPN in FortiSASE.
Scope	FortiSASE, SSL VPN.
Solution	When a SAML issue occurs, it is important to understand the methodology and how to start with troubleshooting: Go To VPN User SSO start the SAML Test as shown below and check what errors are and what is successful or not: Go to FortiSASE -> Configuration -> VPN user SSO TAB, copy the Portal Sign ON URL, and paste it to the browser to do SSL Web authentication. If the Landing page of SSL VPN did not open, that means it might be a problem with FortiSASE. Open a ticket with the Fortinet support team. If the landing page opens as shown in the below screenshot, Press on SSO.   The IDP login page will open as shown below (based on which IDP is configured). Install the SAML tracer, and go through the process of authentication and then, it is possible to see what kind of attributes are sent back to FortiSASE.             Below is the example output of the SAML Tracer after authenticating the user.