ZTNA w/ SAML breaks after upgrade from 7.2.8 to 7.4.6

[doncacciatoconsuting]

I'm using SAML auth with my ZTNA proxy-policy. Everything worked great until I upgraded from 7.2.8 to 7.4.6.

No config changes were made.

This is a 91G model, which according to docs should still support full proxying in 7.4 and above.

The root of the problem is that the Gate (SP) is no longer re-directing the client to the FAC (IDP) for SAML auth. When the client requests https to the ZTNA server, it presents its EMS certificate and is immediately granted access. Prior to the upgrade, it was presented a SAML login page from FAC and everything worked as expected. 

Is there more/different configuration in v7.4.6 ?

config firewall access-proxy

    edit "ztna_https_faz"

        set vip "ztna_https_faz"

        config api-gateway

            edit 1

                config realservers

                    edit 1

                        set ip x.x.x.x

                    next

                end

            next

            edit 2

                set service samlsp

                set saml-server "saml_sp_faz"

                set saml-redirect disable

            next

        end

    next

end

config firewall proxy-policy

    edit 6

        set uuid 2d25fdb0-9dde-51ef-93ff-760c19e3bee0

        set name "ztna_faz_allow"

        set proxy access-proxy

        set access-proxy "ztna_https_faz"

        set srcintf "AT&T-ISP"

        set srcaddr "all"

        set dstaddr "all"

        set ztna-ems-tag "EMS1_ZTNA_all_registered_clients"

        set action accept

        set schedule "always"

        set logtraffic all

        set groups "saml_groups"

        set ssl-ssh-profile "certificate-inspection"

    next

end

config user group

    edit "saml_groups"

        set member "saml_sp_faz"

    next

end

config authentication scheme

    edit "ztna_saml"

        set method saml

        set saml-server "saml_sp_faz"

        set saml-timeout 30

    next

end

config authentication rule

    edit "ztna_saml"

        set srcintf "AT&T-ISP"

        set srcaddr "all"

        set dstaddr "faz_x.x.x.x"

        set active-auth-method "ztna_saml"

next 

 end

config firewall vip

    edit "fac_saml"

        set uuid 2c4b8984-cdd4-51ef-0056-45e0ad38181a

        set extip x.x.x.x

        set mappedip "x.x.x.x"

        set extintf "AT&T-ISP"

        set portforward enable

        set extport 9999

        set mappedport 443

    next

end

[AEK]

Did you follow the upgrade path?

[doncacciatoconsuting]

Thanks for your help. I did follow the upgrade path.

I know that SAML itself is working because from the client I can go directly to https://xxxxxx:9999/saml-idp/portal/ and get authenticated. There must be something in the ZTNA configs that is not telling the client to do this.

[doncacciatoconsuting]

I found this article....

https://community.fortinet.com/t5/ZTNA/Technical-Tip-ZTNA-for-Corporate-hosts-with-SAML-authenticati...

Is this config required (did not have this in 7.2)

If so, what port # should be used??

c.3. Configure the captive portal:

config authentication setting
    set active-auth-scheme "ZTNA_SAML"
    set captive-portal-type IP
    set captive-portal-ip 10.10.10.1
    set captive-portal-port 9998
end

https://community.fortinet.com/t5/ZTNA/Technical-Tip-ZTNA-for-Corporate-hosts-with-SAML-authenticati...

[doncacciatoconsuting]

team, I figured out the issue. It seems that the Proxy Policy I created had some kind of conflict with my ZTNA Firewall Policy. When I disabled the FW policy (which just allowed access to the defined ZTNA servers), things worked as expected with both cert and SAML auth.