Azure SAML SSO prompts to login every time in Forticlient VPN 7.2 and 7.4

[rslygh]

Every time one of our users attempts to login, they are prompted to provide all their credentials. We're using Forticlient VPN (free). The connection is established and works, but on the next login it prompts for the Microsoft login again. This began happening in Forticlient 7.2 and has continued in Forticlient 7.4. This does NOT happen in Forticlient 7.0, so we're still using Forticlient 7.0 in production.

The Fortigate itself has been on various flavors of FortiOS 7.0, 7.2, and 7.4, and the results have been the same for Forticlient.

Our Azure accounts are setup with MFA, and we're using SSL-VPN in tunnel-only mode.

Forticlient 7.0 - connecting with Azure SSO works fine without reprompting for credentials and without needing to change any of the default Forticlient settings

Forticlient 7.2 - connecting with Azure SSO works, but prompts for credentials every login regardless of whether you tell it to remember credentials and MFA authorization or not. 

Forticlient 7.4 - connecting with Azure SSO works, but prompts for credentials every login regardless of whether you tell it to remember credentials and MFA authorization or not when using the default Forticlient settings. If you get to the "Stay signed in" box during the Microsoft login and check the box for "Don't show again" and answer Yes, it fails and you get a -7200 error from Forticlient. I found that if I edit the connection itself and check "Use external browser as user-agent for saml user authentication", then it does appear to log in without requesting new credentials

Has anyone else ran into this, or have any ideas? For now I'll keep using v7.0, but I've had this issue for a long time and the newer Forticlient versions have yet to resolve it so I'm looking for any help to figure out what might be going on before they stop releasing new v7.0 versions.

[Andrzej_PL]

Hi,

set options as in the screenshots

[rslygh]

Doesn't work. I found this KB article related to the "Do not modify internal browser cookies" checkbox earlier and tried it before posting, but no luck. Here are the results I see when doing what you're suggesting (with the use external browser unchecked in the connection settings)

Both checked = immediate -7200 error without any credential prompt

Save Password only checked = credential prompt opens

Do not modify internal browser cookies only checked = credential prompt opens

Having "Do not modify internal browser cookies" checked does prevent the -7200 error from happening later in the credential entry process on the "Stay signed in" page (checking Don't ask again and clicking Yes triggers a -7200 with default settings), but it still requires going through the full login process every time

The only workaround I've found so far that seems to work is the "Use external browser as user-agent for saml user authentication" being checked within the connection configuration

[Andrzej_PL]

maybe this user has his browser permanently set to incognito mode?

[rslygh]

Nope. This user is actually me, but when I originally rolled out v7.2 it was happening to all user so I reverted back to v7.0. Some had Edge as the default, others Chrome, and none that I have seen had Incognito/InPrivate set to the default. I've been testing v7.4 as new minor versions have been released, and so far every release has had the same problem.

I had found a known issue in a v7.2 release that seemed to acknowledge this problem, but that was probably a year ago at this point. I might need to go digging through the release history to find that one and see what happened with it.

Are you running Forticlient VPN v7.2/7.4 with Azure SSO and not experiencing this problem?

[Andrzej_PL]

yes, I am currently using version v7.2.8 and I have no problem with Azure SSO - the credentials are remembered but I do not set options: "Use external browser as user-agent for saml user authentication", but only those indicated in the screenshots

[rslygh]

Using the free Forticlient VPN as well with no EMS? Just trying to double-check to see what might be different, outside of something in the actual configuration of the SSL-VPN or SSO.

[Andrzej_PL]

I have a mixed environment because we are currently migrating to ems, but on both versions I have no problem with saving credentials using Azure SAML

[MZBZ]

Check "AzureAdJoined devices" section of the following KB. You should use Windows Form WebBrowser Control as Internal Browser for seamless Azure SAML login IF the device is AzureAdJaoined or has the account registered in the Work or School. Article exlains in detail.

https://community.fortinet.com/t5/FortiClient/Technical-Tip-FortiClient-SAML-Authentication-Configur...