Getting SAML error with FortiClient EMS Cloud

[systemgeek]

I need some help.  I am tying to register my FortiClients using their individual invitation codes to FortiClient EMS Cloud.  In FortiClient EMS Cloud I am using SAML to our ADFS host.  I have provided the config the CERT to the ADFS host.  In the Relaying Party Trust I have Encryption as blank (no cert).  Under Signature I have the ADFS cert again.

The error the end user is getting is this:  

Error with SAML configuration settings: Signature validation failed. SAML Response rejected, invalid_response
Please notify your EMS Administrator for assistance.

In the Python Debug log I am seeing this:

2024-04-01 06:29:04,767 INFO request_handler POST /fct_saml/iwn8nrmm3e/acs ems-1808417.forticlient-emsproxy.forticloud.com Default application/x-www-form-urlencoded manual
2024-04-01 06:29:04,788 DEBUG ems_logger 6 6 Error with SAML configuration settings: Signature validation failed. SAML Response rejected, invalid_response
2024-04-01 06:29:04,917 INFO request_handler GET /api/v1/settings/server/get localhost:443 Default manual

In the log viewer in EMS Cloud I see this:

[Fortigate Certificate user: FGVMSLTM24000000]: Request completed with message: Serial numbers successfully updated..

Certificate user: FGVMSLTM24000000 FGT authorized 1 fabric device(s): ['FGVMSLTM24000000']

[Fortigate Certificate user: FGVMSLTM24000000]: Request made with body: {'fortigates': {'FGVMSLTM24000000': {'authenticate': 'accept', 'is_root': True, 'vdom': None}}}.

[Fortigate Certificate user: FGVMSLTM24000000]: Request completed with message: Serial numbers successfully updated..

I am pretty sure my issue is Cert related but I am not at all sure where or which cert.

[Anthony_E]

Hello systemgeek,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks,

[cumminsd2]

I wonder how auto-connect would work in this regard. I can imagine it being supported as the external browser would cache the Azure SSO token, given that it is not invalidated requiring you to re-authenticate.

[systemgeek]

What seems to be interesting is that support is telling me that I have the same error regardless if I use the ADFS Services Cert, ADFS Token Signing Cert and ADFS Encryption/Decryption Cert as the IdP cert in Forticlient EMS Cloud.

According to the MS Documentation the ADFS Token Signing Cert contains the key.  So it should be able to decrypt every thing. 

[systemgeek · Accepted solution]

The fix seems to be to remove the Signature and Encryption certs in the relaying party trusts and use the ADFS Signing cert in EMS Cloud.

Then I run in to issues where ADFS is passing the NameID but EMS Cloud is unable to see it.