FortiGate SSL / Integration with Azure for MFA

[Infotech22]

Hello Fortinet people,
I'm currently researching a way of clearing the cache after user login/logoff from FortiClient over SAML login.

Solutions I already tied:

1. Tried with on disconnect script over FortIEMS but no results, I'm not asked for Microsoft login.
2. Tried manually deleting cookies from User's AppData, no results.
3. Shuting down the FortiClient, still no results.

We don't have Premium licenses on Azure so I can't use Conditional Access to configure it there.

Does anybody have some solutions?

[hbac]

Hi @Infotech22,

Please refer to this article and make sure your on disconnect script is correct: https://community.fortinet.com/t5/FortiGate/Technical-Tip-FortiClient-Caching-SSL-VPN-SAML-Authentic...

Also make sure that the following values are disabled:

<save_username>0</save_username> 
<show_remember_password>0</show_remember_password> 

<dont_modify_cookies>0</dont_modify_cookies>

Regards, 

[Infotech22]

Hi @hbac,

I already tried all the steps they suggested on that link.
And still have the same problem.

[hbac]

@Infotech22,

Are you using "Use external browser as user-agent for saml user authentication" option? 

Regards, 

[Infotech22]

@hbac

When I try to add that to the XML file on EMS i get the following error:

 The following errors were found: Remote Access > sslvpn > connections > BIMEXPERTS > use_external_browser: invalid value ['1', '0'], must be boolean

[funkylicious]

Assuming you are trying to set, <use_external_browser>1</use_external_browser> , as per link below ?

L.E. https://docs.fortinet.com/document/forticlient/7.2.4/ems-administration-guide/748803/using-a-browser... , in To configure external browser for authentication in EMS, step 3 

[Infotech22]

@funkylicious,
That was the first thing that I tried when I got that error message.

Yes, that documentation I used. 

[smaruvala]

Hi,

The value should be either 1 or zero as per the XML configuration file. Have you tried to select the option from GUI instead of configuring using the XML format. You can go to EMS-> endpoint profile-> remote access profile-> edit added VPN tunnel->advanced settings and change the settings.

If you are using external browser then you can try to clear the cookie of the default browser using the windows command. For chrome browser you can use the command del C:\users\%username%\AppData\Local\Google\Chrome\"User Data"\Default\Network\Cookies

Regards,

Shiva