VPN SSL authentification with Azure SAML 7.0.12 issue : users not redirected to login page

[miki360]

Hello Evryone,

We are facing a strange issue with our azure saml authetification for vpn users.

The issue is on web mode as well as Forticlient.

The issue is that users are not redirected to azure login page.

->vpn works with local users

->single sign on button appears on web mode (Policy must be ok)

->when we enable debug for samld there is only 1 output :__samld_sp_create_auth_req [447]: SAML SP algo: 0 -> lasso=1. Binding Method: urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST

->When we test on azure (Assertion consumer service URL) we get invalid http request

->on web mode when we click on single sign on we are not redirected to azure and we get ERR_EMPTY_RESPONSE

We have checked multiple times if there was any syntax mismatch between idp and sp but there are none 3 fortinet support engineers also checked

We are running out of ideas.

Did anyone faced this issue ?

Any suggestion is welcome !

Thanks in advance

FortiGate 

[hbac · Accepted solution]

Hi @miki360, 

Do you have a ticket opened? If yes, what is the ticket number? 

We need to doublecheck the configuration, please provide output of the following commands: 

# show full user saml 

# show full vpn ssl setting 

Please also provide screenshots of Azure configurations. 

Regards,

[miki360]

Hello,

Yes we have opened a case and after checking the issue was resolved by disabling sdp certificate. The certificate was generated using the FW ca but we did not get the reason what was wrong with the certificate.

[spoojary]

d you check the below document to find any mismatch : https://learn.microsoft.com/en-us/azure/active-directory/saas-apps/fortigate-ssl-vpn-tutorial

Also posting 4 docs which can help you : 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Create-SSL-VPN-with-Azure-SAML-SSO-Authent...

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Azure-SAML-group-mismatch-getting-error-re...

https://community.fortinet.com/t5/FortiGate/Technical-Tip-SAML-de-authentication-Outbound-SAML-polic...

[mle2802]

Hi there,

This issue usually happen when there is a mismatch in IDP or SP URLs addresses between the FortiGate and Microsoft Azure Single Sign-On page. Can you please verify that information and refer to this document for more detail:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Invalid-HTTP-Request-while-using-sso-login...