Authd process and cpu at 99% - Sso Azure ko after upgrading to 7.2.7 and 7.4.3

[Maerre]

Hello folks,

in my deployment i'm using a fortigate 200F with Sso (Azure) and everything was working correctly before  upgrading from 7.0.12M to 7.2.7.
After the upgrade i'm facing that authd process is constantly consuming 97% of cpu resources and Sso is not working anymore.
Thought it was a bug so decided to upgrade newly from 7.2.7 to 7.4.3 but i still have the issue.

Tried to reboot the firewall (a HA pair) and until there are no authentication requests from clients, the cpu is ok (authd process is not present in the process list or is at 2%), as soon as there's an authetication request the authd process goes to 97% and so the cpu.
In this condition the Sso is not working, i check the configuration and nothing changed, took a debug and sniffer packet from client and all the routing is ok, checked fsso configuration both on firewall and Azure and it's ok.

Did you face something similar? Do you have any advise? The upgrade triggered something but i can't understand what is the root case and in the release note there's nothing about any incompatibility with Fsso.

Following the output:

get system performance top:
Run Time:  0 days, 3 hours and 14 minutes
97U, 0N, 1S, 1I, 0WA, 0HI, 1SI, 0ST; 3962T, 2183F
           authd      261      R      95.2     0.4    0
           authd      260      R      94.8     0.4    1
       ipsengine      342      R <     2.2     1.4    0
       ipsengine      343      S <     1.4     1.3    1
             wad      241      S       1.2     2.0    0
          httpsd     1616      S       1.0     0.4    0
         sslvpnd      190      S       0.8     1.2    1
             wad      240      R       0.4     1.9    0
            node      172      S       0.4     1.7    1
          hasync      203      S <     0.4     1.3    0
       forticron      179      S       0.2     0.7    1
          hatalk      202      S <     0.2     0.5    0
         updated      387      S       0.2     0.4    1
          fnbamd      177      S       0.2     0.4    1
           snmpd      200      S       0.2     0.3    0

FWF200 (global) # get system performance status
CPU states: 95% user 2% system 0% nice 1% idle 0% iowait 0% irq 2% softirq
CPU0 states: 94% user 3% system 0% nice 1% idle 0% iowait 0% irq 2% softirq
CPU1 states: 97% user 1% system 0% nice 1% idle 0% iowait 0% irq 1% softirq
Memory: 4057316k total, 1517896k used (37.4%), 2228268k free (54.9%), 311152k freeable (7.7%)
Average network usage: 67215 / 66085 kbps in 1 minute, 85192 / 83859 kbps in 10 minutes, 90994 / 89877 kbps in 30 minutes
Maximal network usage: 88929 / 87772 kbps in 1 minute, 164915 / 136434 kbps in 10 minutes, 180913 / 172178 kbps in 30 minutes
Average sessions: 7089 sessions in 1 minute, 7101 sessions in 10 minutes, 20449 sessions in 30 minutes
Maximal sessions: 7185 sessions in 1 minute, 7531 sessions in 10 minutes, 46646 sessions in 30 minutes
Average session setup rate: 64 sessions per second in last 1 minute, 64 sessions per second in last 10 minutes, 278 sessions per second in last 30 minutes
Maximal session setup rate: 98 sessions per second in last 1 minute, 161 sessions per second in last 10 minutes, 840 sessions per second in last 30 minutes
Average NPU sessions: 379 sessions in last 1 minute, 373 sessions in last 10 minutes, 383 sessions in last 30 minutes
Maximal NPU sessions: 402 sessions in last 1 minute, 416 sessions in last 10 minutes, 446 sessions in last 30 minutes
Virus caught: 0 total in 1 minute
IPS attacks blocked: 0 total in 1 minute
Uptime: 0 days,  3 hours,  14 minutes

FWF200 (global) # -diagnose sys top
Run Time:  0 days, 3 hours and 12 minutes
98U, 0N, 0S, 1I, 0WA, 0HI, 1SI, 0ST; 3962T, 2171F
           authd      261      R      96.5     0.4    0
           authd      260      R      96.0     0.4    1
       ipsengine      342      S <     2.5     1.4    0
       ipsengine      343      S <     1.5     1.3    1
             wad      241      S       1.0     2.0    1
             wad      240      S       0.5     1.9    0
          hasync      203      S <     0.5     1.3    1
         sslvpnd      190      S       0.5     1.2    1
         miglogd      262      S       0.5     1.1    0
  merged_daemons      175      S       0.5     0.2    0

Thank you

Regards

[Maerre]

hello @Tachu ,

the set idp-single-logout-url was missing

[Toshi_Esumi]

That's why you should run "diag debug config-error-log read" every time you upgrade FGTs. That should have been there with a short description of reason why it was removed.

Toshi

[Tachu]

Thank you @Maerre Funny enough we dont have that on our existing config under 7.2.5 it probably is requred in 7.2.6+ i wil give it a try again. 

We use Google as our SSO and they dont provide a SLO url