Fortigate SSL VPN via Google SAML

[Azur7]

Hi everyone.

I am trying to set up Forticlient VPN users to be able to authenticate and get VPN access using their Google accounts. We have a Fortigate FGT60E with FortiOS 7.4.9 running.

Right now we have a SSL-VPN set up and working fine but with separate account credentials + FortiTokens.

I had tried following different guides I found online + trying to use the logic of my own but I am stuck, based on logs fortigate does not really understand how to map a user to a group. 

I had created a custom SAML app with : ACS : https://MyFQDN:10443/remote/saml/login/
Entity ID: http://MyFQDN:10443/remote/saml/metadata/
Start URL: https://MyFQDN:10443/remote/login
Signed response checked
Certificate valid until 2031.
Basic information > Primary email Attribute mapping : Primary email -> username

On Fortigate side, under User & Authentication SSO I created Google_SAML, with this config :
Entity ID : http://MyFQDN:10443/remote/saml/metadata/
Assertion consumer service URL: https://MyFQDN:10443/remote/saml/login/
Single logout service URL: https://MyFQDN:10443/remote/saml/logout/
Identity Provider configuration:
Entity ID : https://accounts.google.com/o/saml2?idpid=xxxx
Assertion consumer service URL: https://accounts.google.com/o/saml2/idp?idpid=xxxx
Single logout service URL: https://accounts.google.com/o/saml2/idp?idpid=xxxx

Certificate is selected the one from google that I uploaded as Remote Cert.
Attribute used to identify users: username

Note : MyFQDN:10443 is reachable but when I click Single Sign on, I get redirected to google, and when I try to connect with my account I get Forbidden - you don't have permission to acces /remote/saml/login/(null) on this server.
Fortigate logs show : Failed to process response message. ret=101 (Signature element not found)
sslvpn_login_unknown_user

IDP sig verify is required for response and assertions.

Any help is welcome. Thank you in advance.

[funkylicious · Accepted solution]

upgrade to 7.4.10 which fixes the SAML signing.

https://docs.fortinet.com/document/fortigate/7.4.10/fortios-release-notes/454930/saml-certificate-ve... - set it to disable

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-SAML-Authentication-fails-after-firm... 

[joan1]

Thanks both for this post, we were stuck with the 7.4.8 release until now, just testing the 7.4.10 and looks promising.

The only surprise is that the  set require-signed-resp-and-asrt is disabled by default (contrary to the documentation) but should'nt be an issue

[Roi]

Hi
Did SAML with Google works for you ? with 7.4.10?
Did you need to configure something?

[joan1]

7.4.10 and working as expected, no issue (only that this release took months)

Just make sure you have the set require-signed-resp-and-asrt to disabled as mentioned by the docs.

[Roi]

But do you use SAML with Google and it works for you?

[joan1]

Yes, it worked until 7.4.8 and it works with 7.4.10

[Azur7]

I can confirm that with update on 7.4.10 the SAML with Google works. This solved it. Thank you all.