FortiClient SSL VPN - SSO/SAML Issue

[alexisb1]

Hi everyone,

We just configured our SSL VPN with SSO/SAML and are facing issues. 

Some users get stuck at 40% after logging in with their Entra account and going through the MFA process while others are able to connect without any problem. When it gets stuck at 40%, we don't see any logs on the Fortigate, but we can see that it went through the Entra App successfully.

We are using a custom port, Let's Encrypt Cert and we disabled the web mode for the split-tunnel.

The users with issues are in the same group as the one that works successfully. FortiClient is V7.4.0.1658. Fortigate 101F is v7.2.9. 

Thanks

[Shashwati]

Hello, 

Please run the following debug command while testing connection 

diagnose debug console timestamp enable

diagnose debug application samld -1

diagnose debug application sslvpn -1

diagnose debug enable

Refer to the document

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Companion-for-troubleshooting-SSL-VP...

[FortiArt · Accepted solution]

Steps to follow toward solving the problem:

1- Extend authentication timeout on Fortigate as per -> 

config sys global

set remoteauthtimeout 120

end

2-Enable web-mode SSLVPN portal and check if users who have problems are able to connect. If they're able this indicates it's Forticlient issue.

3-Use this article on common problems and causes when using SAML with SSL VPN:

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Common-problems-and-causes-when-usin...

4-Compare the non working users with the working users in terms of Forticlient firmware version, used operating system, security settings on their PCs, any other applications that may interfere with Forticlient connection, etc and try to enable DTLS on Forticlient

Hope this helps

[alexisb1]

Looks like the remoteauthtimeout was the culprit. Setting it to 120 immediately fixed the issue. Thank you!