VPN SSL SAML "Assertion consumer service URL" set up is ignored, Forigate VPN client fails

[gsommariva]

Despite having set "Assertion consumer service URL" in  "config user saml" as "https://FQDN:PORT/remote/login?realm=REALM", 

authentication call always shows:

AssertionConsumerServiceURL="https://FQDN:PORT/remote/saml/login">

The result is that after successful azure authentication, Fortinet VPN SSL clint tries to connect to:

https://FQDN:PORT/remote/saml/login"

and it fails because the Fortigate does not respond to it.

The correct URL is: https://FQDN:PORT/remote/login?realm=REALM

[funkylicious]

hi,

i dont think you need to specify for which realm to use ACS URL because SSLVPN does not run for a specific realm.

the separation of config is done with the remote gateway you configure in the FortiClient SSLVPN Profile on the workstation, e.g. https://FQDN:PORT/REALM and then the usergroup has the SAML User/config in it for that specific REALM.

[gsommariva]

hi,

After the successful login Azure redirects to https://FQDN:PORT/remote/saml/login" and the Fortigate does not respond.

Fortigate responds to https://FQDN:PORT/REALM 

[funkylicious]

it will always respond/open to https://fqdn:port/realm but on the first link, the single-sign-on-url what message do you get ?

you can also start a debug on the fortigate in order to get more details.

diag debug enable

diagnose debug application samld -1

diagnose debug application sslvpn -1

also, 

https://docs.fortinet.com/document/fortigate-public-cloud/7.6.0/azure-administration-guide/584456/co... 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Create-SSL-VPN-with-Azure-SAML-SSO-Authent... 

L.E. https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Companion-for-troubleshooting-SSL-VP... 

[gsommariva]

[360:Internet:3864]got SNI server name: FQDN realm (null)
[360:Internet:3864]client cert requirement: no
[360:Internet:3864]SSL established: TLSv1.3 TLS_AES_256_GCM_SHA384
[360:Internet:3864]req: /remote/info
[360:Internet:3864]capability flags: 0x1cdf
[360:Internet:3864]req: /remote/saml/start?realm=azure
[360:Internet:3864]rmt_web_auth_info_parser_common:525 no session id in auth info
[360:Internet:3864]rmt_web_get_access_cache:874 invalid cache, ret=4103
[360:Internet:3864]sslvpn_auth_check_usrgroup:3050 forming user/group list from policy.
[360:Internet:3864]sslvpn_auth_check_usrgroup:3097 got user (0) group (166:0).
[360:Internet:3864]sslvpn_validate_user_group_list:1940 validating with SSL VPN authentication rules (102), realm (azure).

----

[360:Internet:3864]sslvpn_update_user_group_list:1834 got user (0:0), group (1:0), peer group (0) after update.
[360:Internet:3864][fsv_found_saml_server_name_from_auth_lst:128] Found SAML server [azure] in group [GROUP_SAML]
[360:Internet:3864]saml login [360:14436] SAML_INFO: Found server 'azure' in group 'GROUP_SAML'
samld_process_request [145]: len=423, cmd=0, pid=360, job_id=14436
samld_process_request [162]: Received 423, 0x23b05c0
__samld_sp_create_auth_req [429]: SAML SP algo: 0 -> lasso=1. Binding Method: urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST

__samld_sp_create_auth_req [449]:
**** AuthnRequest URL ****
https://login.microsoftonline.com/XXXXXXXX/saml2?SAMLRequest=XXXX
***********************
__samld_sp_create_auth_req [463]:
**** AuthnRequest ****
<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="_2FC5E9C605B4B9C4E6E2CF1E0954C329" Version="2.0" IssueInstant="2025-03-03T10:53:23Z" Destination="https://login.microsoftonline.com/XXXXX/saml2" SignType="0" SignMethod="0" ForceAuthn="false" IsPassive="false" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" AssertionConsumerServiceURL="https://FQDN:PORT/remote/saml/login"><saml:Issuer>https://FQDN:PORT/remote/saml/metadata</saml:Issuer><samlp:NameIDPolicy Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" AllowCreate="true"/></samlp:AuthnRequest>
***********************
__samld_sp_create_auth_req [468]:

[funkylicious]

i would suggest to do a clean config on the FortiGate side in regards to the SAML configuration and ignore the REALM side in it, just follow it 1:1 and adapt it to your needs but dont add extra stuff in it.

https://learn.microsoft.com/en-us/entra/identity/saas-apps/fortigate-ssl-vpn-tutorial 

[gsommariva]

it is a new saml config.. we never used SAML auth on that Fw.