VPN SSO not working – signature verification errors

[CaryWells]

Our VPN SSO has stopped working. I attempted the following steps without success:

• Enabled the signed response option in Google

• Disabled and re-enabled it

• Downloaded a new certificate from Google and uploaded it to the FortiGate

Despite these changes, SSO is still failing. The FortiGate logs show the following error:

"__samld_sp_login_resp [828]: Failed to process response message. ret=101(Signature element not found.)"

From what I understand, this may be a known issue. Is there a fix or recommended workaround available?

[kaman]

Hi CaryWells,

Could you please provide your FortiOS and FortiClient versions?

Are you facing the issue after the firmware upgrade?

As you mentioned, you got the following error:

"__samld_sp_login_resp [828]: Failed to process response message. ret=101(Signature element not found.)"

Please refer to the document below for more information:

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-SAML-Authentication-fails-after-firm...

If you have found a solution, please like and accept it to make it easily accessible to others.

Regards,
Aman

[CaryWells]

Happened after a firmware upgrade to firmware 7.2.12(1761)

Happens on both client and the web portal

Did all the things in the article including

• a new certificate from Google with the checkbox checked
• deleting the new one and making a new certificate and uploading again.
• making sure the signed response was on by unchecking, saving then checking it again and saving

[kaman]

Hi CaryWells,

Yes, please review the document below and let us know if it helps.

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-SAML-Authentication-fails-after-firm...

If you have found a solution, please like and accept it to make it easily accessible to others.

Regards,
Aman

[CaryWells]

This did not help.

If you look at this reddit tghread you will see I am not the only one this is happening to with Google as the IDP

https://www.reddit.com/r/fortinet/comments/1noj7xu/update_to_7212_kills_saml_at_several_clients/

[kaman]

Hi CaryWells,

Starting from FortiOS 7.2.12, 7.4.9, and 7.6.4, FortiGate verifies the signature for SAML response messages. Please turn on Sign SAML response and assertion or similar options in corresponding IDP settings. Lack of signature for signing response messages or assertions may cause authentication to fail.

Please refer to the release note of v7.2.12:

https://docs.fortinet.com/document/fortigate/7.2.12/fortios-release-notes/684249/saml-certificate-ve...

When using Google as the IdP, ensure that the 'Signed response' option is selected, as shown in the image below. Selecting this option enforces a signature on the entire SAML response. If this option is not selected, Google will sign only the assertion within the response, which is the default behaviour.

You can also try to upgrade to v7.4.8 and check the behaviour.

Regards,
Aman

[CaryWells]

This has been done as I stated in my first response.  We cannot upgrade at this time. This is still not working.

[techevo]

Unfortunatelly it's broken with google : https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-SAML-Authentication-fails-after-firm...

Important info at the end of the document : Note for Google IdP users: The google implementation only signs either the assertion or reply based on the 'Signed reply' checkbox but cannot sign both. If 'Signed reply' is unchecked, only the SAML Assertions are signed. If 'Signed reply' is checked, only the SAML Reply is signed. Both will fail since the FortiGate expects both Assertion AND Reply to be signed.

[funkylicious]

hi,

any fixes that can be applied in order to make this work without reverting to a previous version?

[tbarua]

Hi, 

Google's current implementation of IdP is not compatible with FortiOS  (7.6.4/7.4.9/7.2.12) requirements:

Signed response enabled: Only the whole Reply element is signed
Signed response disabled: Only the Assertion element is signed
But, as per the FOS requirement, BOTH the reply AND Assertion must be signed.