Firewall SSO for VPN with connection to ADFS error

[systemgeek]

I am kinda losing my mind here and really need some help.  I have a ticket opened with support on this and it seems to be going no where.  With support on the call I have re-configured the Firewall SSO setting to not require an ADFS claim.  I have configured ADFS to allow any one who can auth to ADFS to login.  On ADFS I have enabled tracing mode and have only INFO level messages when a user VPNs in via the FortiClient. Yet all through this I am still getting the message:

__samld_sp_login_resp [826]: Failed to process response message. ret=-432(Status code is not success)

samld_send_common_reply [91]: Code: 1, id: 1621, pid: 4149, len: 63, data_len 47

samld_send_common_reply [99]: Attr: 22, 12, P

samld_send_common_reply [99]: Attr: 23, 35, Status code is not success

samld_send_common_reply [119]: Sent resp: 63, pid=4149, job_id=1621.

I used this doc to set up SAML: https://sites.google.com/frellsen.se/kimfrellsen/fortinet-ssl-vpn-with-okta-mfa-using-saml?authuser=....  As a side note.  I have SAML setup for Admins logging into the Fortigate via config system saml.  My ADFS configs are exactly the same (I checked many times).  Both SAML configs go to the same ADFS host.  So in theory they both should work.

Its always the same message.  I have looked and looked and can find nothing that explains that message.  Does any one have any suggestions on how I can better diagnose this problem or what the problem could be????

The Fortigate is a VM in AWS running 7.4.3 Build 2573 if that matters.

[Anthony_E]

Hello systemgeek,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks,

[smaruvala]

Hi,

Do you see any specific error at the same time in the ADFS server side as well? Any error related to a mismatch of any parameters or signature algorithms etc?

Regards,

Shiva

[pminarik]

Is that the ticket where you provided an evtx export from Windows Event log?

The last addressable information there is signature issues reported by the IdP side. Given that you've changed certificates since, what should follow next is a new attempt as usual with new debugs (sslvpn + samld) and the new config backup (just to make sure the current config is known exactly, without any need of guessing), and then have both reviewed by TAC.

[smaruvala]

Hello,

Please check the SAML configuration and check the digest method. If you are using the SHA1 then you can try to change to SHA256 and verify as well.

Regards,

Shiva

[systemgeek]

I ended up on a long call with support.  The answer ended up being all of the above and more.  When I have a second I will give a full answer.  

Thank you for all your responses.