Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
New Contributor

Fortinet Single Sign On (FSSO) for SSL-VPN SAML Entra via Syslog

has anyone used SSL VPN with Microsoft Entra SAML authentication and forwarding of login / logout info to FSSO via syslog? In SAML we use the mail address of the user as UPN.

We want to use the concept to run the authentication of the firewall rules via FSSO Active Directory groups.


Background is the following article:


My problem is that although the syslog message arrives in the FSSO, no query is then sent to the LDAP with the UPN.


Fortigate 600F with 7.4.3



config log syslogd setting
    set status enable
    set server ""

config log syslogd filter
    set forward-traffic disable
    set local-traffic disable
    set multicast-traffic disable
    set sniffer-traffic disable
    set ztna-traffic disable
    set anomaly disable
    set voip disable
    config free-style
        edit 1
            set category event
            set filter "((logid 0101039947) or (logid 0101039948) or (logid 0101039949))"



FSSO logon_event.log


02/15/2024 16:56:23	[RECV_EVENT_FROM_DC]	packet_len:92 dcagent_ip: time:1708012583 data_len:49 data: ip:



Wireshark Syslog + LDAP Request

2024-02-15 17_22_31-Remote Desktop Manager [FSSO-DE01-01].png

2024-02-15 17_24_47-Remote Desktop Manager [FSSO-DE01-01].png

2024-02-15 17_24_04-Remote Desktop Manager [FSSO-DE01-01].png





I guess you have to remove the Group Field in parsing rule since that information will not come from the syslog content itself, it will be extracted from the LDAP server.

When you paste the syslog content on the test field, what values is filled in the Username?

You can also increase the Logging level in Collector Agent:


- Emirjon
If you have found a solution, please like and accept it to make it easily accessible for others.

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Top Kudoed Authors