Loop on SAML authentication page with Edge

[nihonsx5]

Hello,

I am currently testing SAML authentication between FortiGate 7.4.8 and FortiAuthenticator 6.5.6 to allow users to access the internet. The user is running Windows 10 and is on the same VLAN as the FAC and FGT.

Authentication and redirection work perfectly with Firefox 142.0.1 or Chrome 140.0.7339.81. However, with Edge 140.0.3485.54, I get a loop between the FAC and the FGT.

Here is the configuration I use on FortiGate :

config user setting
    set auth-type http https
    set auth-cert "fgt.xxxxxxxxxx.xyz_2025"
    set auth-ca-cert "proxy.xxxxxxxxxx.xyz"
    set auth-timeout 30
end

config user saml
    edit "fac_saml"
        set entity-id "http://fgt.xxxxxxxxxx.xyz:1003/remote/saml/metadata/"
        set single-sign-on-url "https://fgt.xxxxxxxxxx.xyz:1003/remote/saml/login"
        set single-logout-url "https://fgt.xxxxxxxxxx.xyz:1003/remote/saml/logout"
        set idp-entity-id "http://fac.xxxxxxxxxx.xyz/saml-idp/cc7z1kwrro2em2yu/metadata/"
        set idp-single-sign-on-url "https://fac.xxxxxxxxxx.xyz/saml-idp/cc7z1kwrro2em2yu/login/"
        set idp-single-logout-url "https://fac.xxxxxxxxxx.xyz/saml-idp/cc7z1kwrro2em2yu/logout/"
        set idp-cert "fac_saml_idp"
        set user-name "username"
        set group-name "group"
        set digest-method sha256
    next
end

config firewall auth-portal
    set portal-addr "fgt.xxxxxxxxxx.xyz"
end

config user group
    edit "GS-WF-GOLD"
        set member "fac_saml"
        config match
            edit 1
                set server-name "fac_saml"
                set group-name "CN=GS-WF-GOLD,OU=Web Filtering,DC=xxxxxxxxxx,DC=xyz"
            next
        end
    next
end

Here is debug saml with loop :

samld_process_request [145]: len=208, cmd=0, pid=158, job_id=576234
samld_process_request [162]: Received 208, 0x4ee8c0
__update_sp_sig_opt [256]: SP no sig is required.
__samld_sp_create_auth_req [429]: SAML SP algo: 1 -> lasso=4. Binding Method: urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST

__samld_sp_create_auth_req [449]: 
**** AuthnRequest URL ****
https://fac.xxxxxxx.xyz/saml-idp/cc7z1kwrro2em2yu/login/?SAMLRequest=XXXXXXXX%3D&RelayState=magic%3D01000a86c9a8e8af
***********************
__samld_sp_create_auth_req [463]: 
**** AuthnRequest ****
<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="_FE7FCD4995F1A9B336DBB21383A82687" Version="2.0" IssueInstant="2025-09-03T22:14:02Z" Destination="https://fac.xxxxxxx.xyz/saml-idp/cc7z1kwrro2em2yu/login/" SignType="0" SignMethod="0" ForceAuthn="false" IsPassive="false" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" AssertionConsumerServiceURL="https://fgt.xxxxxxx.xyz:1003/remote/saml/login"><saml:Issuer>http://fgt.xxxxxxx.xyz:1003/remote/saml/metadata/</saml:Issuer><samlp:NameIDPolicy Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" AllowCreate="true"/></samlp:AuthnRequest>
***********************
__samld_sp_create_auth_req [468]: 
**** SP Login Dump ****
<lasso:Login xmlns:lasso="http://www.entrouvert.org/namespaces/lasso/0.0" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" LoginDumpVersion="2"><lasso:Request><samlp:AuthnRequest ID="_FE7FCD4995F1A9B336DBB21383A82687" Version="2.0" IssueInstant="2025-09-03T22:14:02Z" Destination="https://fac.xxxxxxx.xyz/saml-idp/cc7z1kwrro2em2yu/login/" SignType="0" SignMethod="0" ForceAuthn="false" IsPassive="false" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" AssertionConsumerServiceURL="https://fgt.xxxxxxx.xyz:1003/remote/saml/login"><saml:Issuer>http://fgt.xxxxxxx.xyz:1003/remote/saml/metadata/</saml:Issuer><samlp:NameIDPolicy Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" AllowCreate="true"/></samlp:AuthnRequest></lasso:Request><lasso:RemoteProviderID>http://fac.xxxxxxx.xyz/saml-idp/cc7z1kwrro2em2yu/metadata/</lasso:RemoteProviderID><lasso:MsgUrl>https://fac.xxxxxxx.xyz/saml-idp/cc7z1kwrro2em2yu/login/?SAMLRequest=XXXXXXXX%3D&amp;RelayState=magic%3D01000a86c9a8e8af</lasso:MsgUrl><lasso:MsgRelayState>magic=01000a86c9a8e8af</lasso:MsgRelayState><lasso:HttpRequestMethod>4</lasso:HttpRequestMethod><lasso:RequestID>_FE7FCD4995F1A9B336DBB21383A82687</lasso:RequestID></lasso:Login>
***********************
samld_send_common_reply [91]: Code: 0, id: 576234, pid: 158, len: 2444, data_len 2428
samld_send_common_reply [99]:     Attr: 14, 1789, <lasso:Login xmlns:lasso="http://www.entrouvert.org/namespaces/lasso/0.0" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" LoginDumpVersion="2"><lasso:Request><samlp:AuthnRequest ID="_FE7FCD4995F1A9B336DBB21383A82687" Version="2.0" IssueInstant="2025-09-03T22:14:02Z" Destination="https://fac.xxxxxxx.xyz/saml-idp/cc7z1kwrro2em2yu/login/" SignType="0" SignMethod="0" ForceAuthn="false" IsPassive="false" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" AssertionConsumerServiceURL="https://fgt.xxxxxxx.xyz:1003/remote/saml/login"><saml:Issuer>http://fgt.xxxxxxx.xyz:1003/remote/saml/metadata/</saml:Issuer><samlp:NameIDPolicy Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" AllowCreate="true"/></samlp:AuthnRequest></lasso:Request><lasso:RemoteProviderID>http://fac.xxxxxxx.xyz/saml-idp/cc7z1kwrro2em2yu/metadata/</lasso:RemoteProviderID><lasso:MsgUrl>https://fac.xxxxxxx.xyz/saml-idp/cc7z1kwrro2em2yu/login/?SAMLRequest=XXXXXXXX%3D&amp;RelayState=magic%3D01000a86c9a8e8af</lasso:MsgUrl><lasso:MsgRelayState>magic=01000a86c9a8e8af</lasso:MsgRelayState><lasso:HttpRequestMethod>4</lasso:HttpRequestMethod><lasso:RequestID>_FE7FCD4995F1A9B336DBB21383A82687</lasso:RequestID></lasso:Login>
samld_send_common_reply [99]:     Attr: 11, 639, https://fac.xxxxxxx.xyz/saml-idp/cc7z1kwrro2em2yu/login/?SAMLRequest=XXXXXXXX%3D&RelayState=magic%3D01000a86c9a8e8af
samld_send_common_reply [119]: Sent resp: 2444, pid=158, job_id=576234.
samld_process_request [145]: len=208, cmd=0, pid=158, job_id=576234
samld_process_request [162]: Received 208, 0x4ee8c0
__update_sp_sig_opt [256]: SP no sig is required.
__samld_sp_create_auth_req [429]: SAML SP algo: 1 -> lasso=4. Binding Method: urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST

__samld_sp_create_auth_req [449]: 
**** AuthnRequest URL ****
https://fac.xxxxxxx.xyz/saml-idp/cc7z1kwrro2em2yu/login/?SAMLRequest=XXXXXXXX%3D%3D&RelayState=magic%3D01000a86c9a8e8af
***********************
__samld_sp_create_auth_req [463]: 
**** AuthnRequest ****
<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="_12933AB4937D80D06AEECC206D213CDE" Version="2.0" IssueInstant="2025-09-03T22:14:13Z" Destination="https://fac.xxxxxxx.xyz/saml-idp/cc7z1kwrro2em2yu/login/" SignType="0" SignMethod="0" ForceAuthn="false" IsPassive="false" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" AssertionConsumerServiceURL="https://fgt.xxxxxxx.xyz:1003/remote/saml/login"><saml:Issuer>http://fgt.xxxxxxx.xyz:1003/remote/saml/metadata/</saml:Issuer><samlp:NameIDPolicy Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" AllowCreate="true"/></samlp:AuthnRequest>
***********************
__samld_sp_create_auth_req [468]: 
**** SP Login Dump ****
<lasso:Login xmlns:lasso="http://www.entrouvert.org/namespaces/lasso/0.0" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" LoginDumpVersion="2"><lasso:Request><samlp:AuthnRequest ID="_12933AB4937D80D06AEECC206D213CDE" Version="2.0" IssueInstant="2025-09-03T22:14:13Z" Destination="https://fac.xxxxxxx.xyz/saml-idp/cc7z1kwrro2em2yu/login/" SignType="0" SignMethod="0" ForceAuthn="false" IsPassive="false" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" AssertionConsumerServiceURL="https://fgt.xxxxxxx.xyz:1003/remote/saml/login"><saml:Issuer>http://fgt.xxxxxxx.xyz:1003/remote/saml/metadata/</saml:Issuer><samlp:NameIDPolicy Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" AllowCreate="true"/></samlp:AuthnRequest></lasso:Request><lasso:RemoteProviderID>http://fac.xxxxxxx.xyz/saml-idp/cc7z1kwrro2em2yu/metadata/</lasso:RemoteProviderID><lasso:MsgUrl>https://fac.xxxxxxx.xyz/saml-idp/cc7z1kwrro2em2yu/login/?SAMLRequest=XXXXXXXX%3D%3D&amp;RelayState=magic%3D01000a86c9a8e8af</lasso:MsgUrl><lasso:MsgRelayState>magic=01000a86c9a8e8af</lasso:MsgRelayState><lasso:HttpRequestMethod>4</lasso:HttpRequestMethod><lasso:RequestID>_12933AB4937D80D06AEECC206D213CDE</lasso:RequestID></lasso:Login>
***********************
samld_send_common_reply [91]: Code: 0, id: 576234, pid: 158, len: 2448, data_len 2432
samld_send_common_reply [99]:     Attr: 14, 1791, <lasso:Login xmlns:lasso="http://www.entrouvert.org/namespaces/lasso/0.0" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" LoginDumpVersion="2"><lasso:Request><samlp:AuthnRequest ID="_12933AB4937D80D06AEECC206D213CDE" Version="2.0" IssueInstant="2025-09-03T22:14:13Z" Destination="https://fac.xxxxxxx.xyz/saml-idp/cc7z1kwrro2em2yu/login/" SignType="0" SignMethod="0" ForceAuthn="false" IsPassive="false" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" AssertionConsumerServiceURL="https://fgt.xxxxxxx.xyz:1003/remote/saml/login"><saml:Issuer>http://fgt.xxxxxxx.xyz:1003/remote/saml/metadata/</saml:Issuer><samlp:NameIDPolicy Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" AllowCreate="true"/></samlp:AuthnRequest></lasso:Request><lasso:RemoteProviderID>http://fac.xxxxxxx.xyz/saml-idp/cc7z1kwrro2em2yu/metadata/</lasso:RemoteProviderID><lasso:MsgUrl>https://fac.xxxxxxx.xyz/saml-idp/cc7z1kwrro2em2yu/login/?SAMLRequest=XXXXXXXX%3D%3D&amp;RelayState=magic%3D01000a86c9a8e8af</lasso:MsgUrl><lasso:MsgRelayState>magic=01000a86c9a8e8af</lasso:MsgRelayState><lasso:HttpRequestMethod>4</lasso:HttpRequestMethod><lasso:RequestID>_12933AB4937D80D06AEECC206D213CDE</lasso:RequestID></lasso:Login>
samld_send_common_reply [99]:     Attr: 11, 641, https://fac.xxxxxxx.xyz/saml-idp/cc7z1kwrro2em2yu/login/?SAMLRequest=XXXXXXXX%3D%3D&RelayState=magic%3D01000a86c9a8e8af
samld_send_common_reply [119]: Sent resp: 2448, pid=158, job_id=576234.
samld_process_request [145]: len=208, cmd=0, pid=158, job_id=576234
samld_process_request [162]: Received 208, 0x4ee8c0
__update_sp_sig_opt [256]: SP no sig is required.
__samld_sp_create_auth_req [429]: SAML SP algo: 1 -> lasso=4. Binding Method: urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST

__samld_sp_create_auth_req [449]: 
**** AuthnRequest URL ****
https://fac.xxxxxxx.xyz/saml-idp/cc7z1kwrro2em2yu/login/?SAMLRequest=XXXXXXXX&RelayState=magic%3D01000a86c9a8e8af
***********************
__samld_sp_create_auth_req [463]: 
**** AuthnRequest ****
<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="_7D51433E3C8CF9902EC928C5D82CE836" Version="2.0" IssueInstant="2025-09-03T22:14:13Z" Destination="https://fac.xxxxxxx.xyz/saml-idp/cc7z1kwrro2em2yu/login/" SignType="0" SignMethod="0" ForceAuthn="false" IsPassive="false" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" AssertionConsumerServiceURL="https://fgt.xxxxxxx.xyz:1003/remote/saml/login"><saml:Issuer>http://fgt.xxxxxxx.xyz:1003/remote/saml/metadata/</saml:Issuer><samlp:NameIDPolicy Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" AllowCreate="true"/></samlp:AuthnRequest>
***********************
__samld_sp_create_auth_req [468]: 
**** SP Login Dump ****
<lasso:Login xmlns:lasso="http://www.entrouvert.org/namespaces/lasso/0.0" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" LoginDumpVersion="2"><lasso:Request><samlp:AuthnRequest ID="_7D51433E3C8CF9902EC928C5D82CE836" Version="2.0" IssueInstant="2025-09-03T22:14:13Z" Destination="https://fac.xxxxxxx.xyz/saml-idp/cc7z1kwrro2em2yu/login/" SignType="0" SignMethod="0" ForceAuthn="false" IsPassive="false" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" AssertionConsumerServiceURL="https://fgt.xxxxxxx.xyz:1003/remote/saml/login"><saml:Issuer>http://fgt.xxxxxxx.xyz:1003/remote/saml/metadata/</saml:Issuer><samlp:NameIDPolicy Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" AllowCreate="true"/></samlp:AuthnRequest></lasso:Request><lasso:RemoteProviderID>http://fac.xxxxxxx.xyz/saml-idp/cc7z1kwrro2em2yu/metadata/</lasso:RemoteProviderID><lasso:MsgUrl>https://fac.xxxxxxx.xyz/saml-idp/cc7z1kwrro2em2yu/login/?SAMLRequest=XXXXXXXX&amp;RelayState=magic%3D01000a86c9a8e8af</lasso:MsgUrl><lasso:MsgRelayState>magic=01000a86c9a8e8af</lasso:MsgRelayState><lasso:HttpRequestMethod>4</lasso:HttpRequestMethod><lasso:RequestID>_7D51433E3C8CF9902EC928C5D82CE836</lasso:RequestID></lasso:Login>
***********************
samld_send_common_reply [91]: Code: 0, id: 576234, pid: 158, len: 2468, data_len 2452
samld_send_common_reply [99]:     Attr: 14, 1801, <lasso:Login xmlns:lasso="http://www.entrouvert.org/namespaces/lasso/0.0" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" LoginDumpVersion="2"><lasso:Request><samlp:AuthnRequest ID="_7D51433E3C8CF9902EC928C5D82CE836" Version="2.0" IssueInstant="2025-09-03T22:14:13Z" Destination="https://fac.xxxxxxx.xyz/saml-idp/cc7z1kwrro2em2yu/login/" SignType="0" SignMethod="0" ForceAuthn="false" IsPassive="false" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" AssertionConsumerServiceURL="https://fgt.xxxxxxx.xyz:1003/remote/saml/login"><saml:Issuer>http://fgt.xxxxxxx.xyz:1003/remote/saml/metadata/</saml:Issuer><samlp:NameIDPolicy Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" AllowCreate="true"/></samlp:AuthnRequest></lasso:Request><lasso:RemoteProviderID>http://fac.xxxxxxx.xyz/saml-idp/cc7z1kwrro2em2yu/metadata/</lasso:RemoteProviderID><lasso:MsgUrl>https://fac.xxxxxxx.xyz/saml-idp/cc7z1kwrro2em2yu/login/?SAMLRequest=XXXXXXXX&amp;RelayState=magic%3D01000a86c9a8e8af</lasso:MsgUrl><lasso:MsgRelayState>magic=01000a86c9a8e8af</lasso:MsgRelayState><lasso:HttpRequestMethod>4</lasso:HttpRequestMethod><lasso:RequestID>_7D51433E3C8CF9902EC928C5D82CE836</lasso:RequestID></lasso:Login>
samld_send_common_reply [99]:     Attr: 11, 651, https://fac.xxxxxxx.xyz/saml-idp/cc7z1kwrro2em2yu/login/?SAMLRequest=XXXXXXXX&RelayState=magic%3D01000a86c9a8e8af
samld_send_common_reply [119]: Sent resp: 2468, pid=158, job_id=576234.
samld_process_request [145]: len=208, cmd=0, pid=158, job_id=576234
samld_process_request [162]: Received 208, 0x4ee8c0
__update_sp_sig_opt [256]: SP no sig is required.
__samld_sp_create_auth_req [429]: SAML SP algo: 1 -> lasso=4. Binding Method: urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST

__samld_sp_create_auth_req [449]: 

The certificates (root and intermediate) are correctly installed on the computer. I imagine there is a setting to change on Edge. But I haven't found it yet.

[Jean-Philippe_P]

Hello nhonsx5, 

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible. 

Thanks, 

[Jean-Philippe_P]

Hello,

We are still looking for an answer to your question.

We will come back to you ASAP.

Thanks,

[Jean-Philippe_P]

Hello nihonsx5,

I found this solution. Can you tell us if it helps, please?

The issue you're experiencing with Microsoft Edge could be related to how the browser handles SAML authentication or specific security settings. Here are some steps you can take to troubleshoot and potentially resolve the issue:

1. Clear Browser Cache and Cookies: Clear the cache and cookies in Microsoft Edge to ensure no stale sessions or cached data are causing the loop.
   
   
2. Check Security Settings: Ensure that Edge is not blocking third-party cookies, as this can interfere with SAML authentication. Go to `Settings > Cookies and site permissions > Manage and delete cookies and site data` and ensure that third-party cookies are allowed.
   
   
3. Disable Extensions: Temporarily disable any browser extensions that might interfere with the authentication process, such as ad blockers or privacy tools.
   
   
4. Check Certificate Trust: Verify that the root and intermediate certificates are correctly installed and trusted by Edge. You can check this in `Settings > Privacy, search, and services > Manage certificates`.
   
   
5. Compatibility Mode: Try running Edge in compatibility mode for older versions of Internet Explorer, if applicable, to see if it resolves the issue.
   
   
6. Update Edge: Ensure that Microsoft Edge is updated to the latest version, as updates may include fixes for known issues.
   
   
7. Review SAML Configuration: Double-check the SAML configuration on both FortiGate and FortiAuthenticator to ensure there are no discrepancies or misconfigurations.
   
   
8. Network Logs: Review network logs and SAML debug logs for any errors or warnings that might provide more insight into the issue.

If the issue persists after trying these steps, consider reaching out to Microsoft support for further assistance, as the problem may be specific to the Edge browser's handling of SAML authentication.