after introduction of http_authd saml admin login don't work anymore

[zaxtron]

using Administration login via SAML, custom keycloak  server

config system saml
    set status enable
    set default-profile "no-permission"
    set entity-id "http://xxxxxx:8443/metadata/"
    set idp-entity-id "https://yyyyy/realms/realm_a"
    set idp-single-sign-on-url "https://yyyyy/realms/realm_a/protocol/saml"
    set idp-single-logout-url "https://yyyyy/realms/realm_a/protocol/saml"
    set idp-cert "keycloak-IDP"
    set server-address "xxxxxx:8443"
end

This always worked, but suddenly fortigate introduced `http_authd` in 7.6.4 and since then SAML admin login is broken.
just tested in 7.6.5 but same problem, had to downgrade to 7.6.3 which works fine, though it has a bug where SAML admin sso login session can't open the web terminal.

[zaxtron · Accepted solution]

I've found the cause of the problem.
This new authentication daemon http_authd introduced in 7.6.4 can't handle a large SAML Response payload from IDP (the size of the SAML document)
Our IDP was sending all the VPN roles/groups along in the SAML Response Assertion and that made the POST payload large +30kb and this crashes the http_authd daemon in fortigate.
That is also the reason nothing shows in the debug diagnoses, because the daemon crashes, thus making it difficult to debug.
We just removed the attribute with the VPN roles in the SAML response (it is not needed anyway for `config system saml`, they are only needed for `config user saml`) that reduced the SAML response payload and now it is working.
It is a bug in http_authd, I hope Fortigate fixes that sometime by allowing a large payload, or even at least handle this case and print in the debug logs that the payload size is too large instead of crash and print nothing

[funkylicious]

out of curiosity since i didnt test keycloak for saml admin auth, can you share the client config in KC ? i'm interested in any mappers or settings for the client/FGT.