SSL-VPN AzureAD MFA sign in timer

[PNCC-Jimmy]

I have recently successfully set up our SSL-VPN with AzureAD SSO including MFA (conditional access)

Users are able to go through the process, sign in successfully and gain access, but there is a desire to extend the Azure MFA sign in window timeout process/prompts. By default, it appears there is a 30sec timer countdown set somewhere and it starts counting down in the sign-in window title bar as soon as the Azure window pops.

After doing some reading around these forums, on the FortiGate itself, i doubled the default timers for the 5 x "config sys global > set two-factor--xxxx" options but as expected, no change. I also up'ed the "config sys global > set remoteauthtimeout" to 10sec instead of the default 5.

*****
set remoteauthtimeout 10
set switch-controller enable
set timezone 71
set two-factor-email-expiry 120
set two-factor-fac-expiry 120
set two-factor-ftk-expiry 120
set two-factor-ftm-expiry 120
set two-factor-sms-expiry 120

*****

I have loosely looked through Azure and can't find much. We aren't using any on-prem or server NPS.

Where is this time being controlled from? Is there a way to extend this timer to more than 30sec? And if so, where/how?

Please let me know if there is a requirement for specific versions and or set up to provide a better picture of my scenario.

Thanks

[Demir21 · Accepted solution]

Hi, 

Please try to change the remoteauthtimeout under global settings to 60 seconds and check the behaviour.

[PNCC-Jimmy]

SSO countdown timer for AzureAD auth and MFA config is indeed controlled by the "remoteauthtimeout" setting in global settings. Thank you for the quick suggestion and quick fix

[Debbie_FTNT]

Hey PNCC-Jimmy,

to clarify the timing behavior:

- The main relevant timeout on FortiGate would be the remoteauthtimeout

-> that's how long the FortiGate will keep an SSLVPN authentication attempt active while waiting for a response from a remote server like SAML/LDAP/RADIUS

-> if this is too short, you would see issues with VPN not establishing after the SAML authentication - 'ERR_EMPTY_RESPONSE', or some HTTP errors, are quite common

-> increasing the remoteauthtimeout can help in those instances

If you have an issue with the MFA code/response not being accepted a certain time after you provide the user credentials, that's probably more on Azure side - Azure checks the credentials and MFA component, and would have related timers set somewhere (no idea where though), while FortiGate simply waits for the result of the authentication; FortiGate would not even be aware that there is an MFA component, as the entire authentication side is handled by Azure.

[jpsilva]

Hi, In my case I follow the Fortinet documentation in this link: Fortinet documentation.
But, to change the time to login was necessary change this configuration: 

config system global

set remoteauthtimeout 60

end

With this configuration was possible gave 120 seconds to users to login.