FORTIGATE - SAML Debug - Revision history

Admin at 06:56, 6 July 2026

2026-07-06T06:56:54Z

← Older revision		Revision as of 06:56, 6 July 2026
Line 90:		Line 90:
	diagnose debug enable</nowiki>		diagnose debug enable</nowiki>

	=== The IPsec Case ===		== The IPsec Case ==

	==== IKE Gateway State (Primary Equivalent) ====		=== IKE Gateway State (Primary Equivalent) ===

	This is the closest equivalent to “who is connected” in IPsec.		This is the closest equivalent to “who is connected” in IPsec.
Line 108:		Line 108:
	Use this as the primary “session-like” view for IPsec.		Use this as the primary “session-like” view for IPsec.

	==== IPsec Tunnel State (Data Plane View) ====		=== IPsec Tunnel State (Data Plane View) ===

	Shows active encrypted tunnels and traffic selectors.		Shows active encrypted tunnels and traffic selectors.
Line 124:		Line 124:
	This is equivalent to “active VPN data sessions”.		This is equivalent to “active VPN data sessions”.

	==== Summary View ====		=== Summary View ===

	Quick overview of active IPsec tunnels:		Quick overview of active IPsec tunnels:

Admin at 06:55, 6 July 2026

2026-07-06T06:55:56Z

@@ Line 89: / Line 89: @@
 diagnose debug application ike -1
 diagnose debug enable</nowiki>
 === IPsec tunnel negotiation debugging ===

Admin at 06:24, 6 July 2026

2026-07-06T06:24:13Z

← Older revision		Revision as of 06:24, 6 July 2026
Line 9:		Line 9:
	Enable timestamps before collecting any debug output to simplify correlation with client and identity provider logs.		Enable timestamps before collecting any debug output to simplify correlation with client and identity provider logs.

	<nowiki>		<nowiki>
	diagnose debug console timestamp enable		diagnose debug console timestamp enable
	diagnose debug reset		diagnose debug reset
Line 20:		Line 20:
	Always disable debugging after troubleshooting to avoid unnecessary CPU usage and excessive log generation.		Always disable debugging after troubleshooting to avoid unnecessary CPU usage and excessive log generation.

	<nowiki>		<nowiki>
	diagnose debug disable		diagnose debug disable
	diagnose debug reset</nowiki>		diagnose debug reset</nowiki>
Line 28:		Line 28:
	Check that SAML daemon is actually processing authentication requests.		Check that SAML daemon is actually processing authentication requests.

	<nowiki>		<nowiki>
	diagnose sys process pidof samld		diagnose sys process pidof samld
	diagnose sys top</nowiki>		diagnose sys top</nowiki>
Line 36:		Line 36:
	=== Display current SAML sessions ===		=== Display current SAML sessions ===

	<nowiki>		<nowiki>
	diagnose vpn ssl saml-session list</nowiki>		diagnose vpn ssl saml-session list</nowiki>

	Example:		Example:

	<nowiki>		<nowiki>
	Session ID : 9		Session ID : 9
	User : john.doe		User : john.doe
Line 51:		Line 51:
	=== Display authenticated users ===		=== Display authenticated users ===

	<nowiki>		<nowiki>
	diagnose firewall auth list</nowiki>		diagnose firewall auth list</nowiki>

	=== Display session table ===		=== Display session table ===

	<nowiki>		<nowiki>
	diagnose sys session list</nowiki>		diagnose sys session list</nowiki>

Line 63:		Line 63:
	=== Enable SSL VPN debug ===		=== Enable SSL VPN debug ===

	<nowiki>		<nowiki>
	diagnose debug application sslvpn -1		diagnose debug application sslvpn -1
	diagnose debug enable</nowiki>		diagnose debug enable</nowiki>
Line 69:		Line 69:
	=== View SSL VPN sessions ===		=== View SSL VPN sessions ===

	<nowiki>		<nowiki>
	get vpn ssl monitor</nowiki>		get vpn ssl monitor</nowiki>

	=== SSL VPN configuration check ===		=== SSL VPN configuration check ===

	<nowiki>		<nowiki>
	show vpn ssl settings</nowiki>		show vpn ssl settings</nowiki>

Line 85:		Line 85:
	Authentication is handled by fnbamd (same as SAML group mapping logic).		Authentication is handled by fnbamd (same as SAML group mapping logic).

	<nowiki>		<nowiki>
	diagnose debug application fnbamd -1		diagnose debug application fnbamd -1
	diagnose debug application ike -1		diagnose debug application ike -1
Line 92:		Line 92:
	=== IPsec tunnel negotiation debugging ===		=== IPsec tunnel negotiation debugging ===

	<nowiki>		<nowiki>
	diagnose debug application ike -1		diagnose debug application ike -1
	diagnose vpn ike gateway list		diagnose vpn ike gateway list
Line 99:		Line 99:
	=== Live IKE negotiation trace ===		=== Live IKE negotiation trace ===

	<nowiki>		<nowiki>
	diagnose debug console timestamp enable		diagnose debug console timestamp enable
	diagnose debug reset		diagnose debug reset
Line 107:		Line 107:
	Filter by peer IP:		Filter by peer IP:

	<nowiki>		<nowiki>
	diagnose vpn ike log-filter addr <peer_ip></nowiki>		diagnose vpn ike log-filter addr <peer_ip></nowiki>

	Stop debug:		Stop debug:

	<nowiki>		<nowiki>
	diagnose debug disable		diagnose debug disable
	diagnose debug reset</nowiki>		diagnose debug reset</nowiki>
Line 134:		Line 134:
	== Web authentication (shared backend) ==		== Web authentication (shared backend) ==

	<nowiki>		<nowiki>
	diagnose debug application fnbamd -1		diagnose debug application fnbamd -1
	diagnose debug enable</nowiki>		diagnose debug enable</nowiki>
Line 146:		Line 146:
	== Certificates validation ==		== Certificates validation ==

	<nowiki>		<nowiki>
	show full-configuration vpn certificate local		show full-configuration vpn certificate local
	show full-configuration vpn certificate ca</nowiki>		show full-configuration vpn certificate ca</nowiki>
Line 152:		Line 152:
	== Time synchronization (critical for SAML) ==		== Time synchronization (critical for SAML) ==

	<nowiki>		<nowiki>
	get system status		get system status
	diagnose sys ntp status</nowiki>		diagnose sys ntp status</nowiki>
Line 160:		Line 160:
	=== SAML / HTTPS ===		=== SAML / HTTPS ===

	<nowiki>		<nowiki>
	diagnose sniffer packet any "host <idp_ip>" 4 0 a</nowiki>		diagnose sniffer packet any "host <idp_ip>" 4 0 a</nowiki>

	=== IPsec IKE ===		=== IPsec IKE ===

	<nowiki>		<nowiki>
	diagnose sniffer packet any "udp port 500 or udp port 4500" 4 0 a</nowiki>		diagnose sniffer packet any "udp port 500 or udp port 4500" 4 0 a</nowiki>

	== Flow debugging (authentication path) ==		== Flow debugging (authentication path) ==

	<nowiki>		<nowiki>
	diagnose debug reset		diagnose debug reset
	diagnose debug flow filter clear		diagnose debug flow filter clear
Line 179:		Line 179:
	Filter:		Filter:

	<nowiki>		<nowiki>
	diagnose debug flow filter addr <client_ip></nowiki>		diagnose debug flow filter addr <client_ip></nowiki>

	Stop:		Stop:

	<nowiki>		<nowiki>
	diagnose debug disable		diagnose debug disable
	diagnose debug reset</nowiki>		diagnose debug reset</nowiki>

Admin at 06:23, 6 July 2026

2026-07-06T06:23:30Z

← Older revision		Revision as of 06:23, 6 July 2026
Line 1:		Line 1:
	~~[[Category:Wiki]]~~

	~~'''''[https://it-arts.net/index.php/Category:Wiki Return to Wiki Index]'''''~~
	[[Category:Wiki]]		[[Category:Wiki]]

Line 237:		Line 234:
	* https://learn.microsoft.com/entra/identity/		* https://learn.microsoft.com/entra/identity/
	* https://wiki.oasis-open.org/security/saml		* https://wiki.oasis-open.org/security/saml

	~~----~~

	~~'''''[https://it-arts.net/index.php/Category:Wiki Return to Wiki Index]'''''~~

	----		----

	'''''[https://it-arts.net/index.php/Category:Wiki Return to Wiki Index]'''''		'''''[https://it-arts.net/index.php/Category:Wiki Return to Wiki Index]'''''

Admin at 06:23, 6 July 2026

2026-07-06T06:23:08Z

Show changes

Admin: Created page with "Category:Wiki '''''[https://it-arts.net/index.php/Category:Wiki Return to Wiki Index]''''' == Debug SAML Authentication == === Enable timestamped debugging === Enable timestamps before collecting any debug output to simplify correlation with client and identity provider logs. diagnose debug console timestamp enable diagnose debug reset diagnose debug application samld -1 diagnose debug enable === Disable debugging === Always disable debuggi..."

2026-07-06T05:44:48Z

Created page with "Category:Wiki '''''[https://it-arts.net/index.php/Category:Wiki Return to Wiki Index]''''' == Debug SAML Authentication == === Enable timestamped debugging === Enable timestamps before collecting any debug output to simplify correlation with client and identity provider logs. <nowiki> diagnose debug console timestamp enable diagnose debug reset diagnose debug application samld -1 diagnose debug enable </nowiki> === Disable debugging === Always disable debuggi..."

New page

[[Category:Wiki]]

'''''[https://it-arts.net/index.php/Category:Wiki Return to Wiki Index]'''''

== Debug SAML Authentication ==

=== Enable timestamped debugging ===

Enable timestamps before collecting any debug output to simplify correlation with client and identity provider logs.

<nowiki>
diagnose debug console timestamp enable
diagnose debug reset
diagnose debug application samld -1
diagnose debug enable
</nowiki>

=== Disable debugging ===

Always disable debugging after troubleshooting to avoid unnecessary CPU usage and excessive log generation.

<nowiki>
diagnose debug disable
diagnose debug reset
</nowiki>

=== Enable verbose samld debugging ===

Display all SAML daemon messages.

<nowiki>
diagnose debug application samld -1
</nowiki>

Higher verbosity is useful during:

* Initial SAML deployment
* Certificate validation failures
* Assertion parsing problems
* Group mapping verification
* Logout debugging

=== Filter debugging by process ===

Display currently running SAML daemon.

<nowiki>
diagnose sys process pidof samld
</nowiki>

Display process information.

<nowiki>
diagnose sys top
</nowiki>

== SAML Runtime Information ==

=== Display current SAML sessions ===

<nowiki>
diagnose vpn ssl saml-session list
</nowiki>

Example:

<nowiki>
Session ID : 9
User : john.doe
Group : VPN_Users
Portal : full-access
IdP : AzureAD
Login time : 2026-07-04 09:54:13
</nowiki>

=== Display active authenticated users ===

<nowiki>
diagnose firewall auth list
</nowiki>

Useful for verifying whether SAML authentication has been translated into a FortiGate authenticated user.

=== Display user sessions ===

<nowiki>
diagnose sys session list
</nowiki>

Useful when troubleshooting SSL-VPN or explicit proxy authentication.

== SSL VPN Debugging ==

=== Enable SSL-VPN debugging ===

<nowiki>
diagnose debug application sslvpn -1
diagnose debug enable
</nowiki>

This displays:

* Portal selection
* Authentication process
* SAML redirect
* Group assignment
* Tunnel establishment

=== Display SSL-VPN users ===

<nowiki>
get vpn ssl monitor
</nowiki>

=== Display SSL-VPN settings ===

<nowiki>
show vpn ssl settings
</nowiki>

== Web Authentication Debugging ==

Display authentication daemon debugging.

<nowiki>
diagnose debug application fnbamd -1
diagnose debug enable
</nowiki>

Useful for:

* Group lookup
* User mapping
* LDAP interaction
* RADIUS interaction
* SAML user processing

== SAML Certificate Verification ==

=== Display configured certificates ===

<nowiki>
show full-configuration vpn certificate local
</nowiki>

Display CA certificates.

<nowiki>
show full-configuration vpn certificate ca
</nowiki>

Display remote certificate information.

<nowiki>
get vpn certificate local
</nowiki>

=== Verify expiration ===

Always verify:

* IdP signing certificate
* SP certificate
* Intermediate CA
* Root CA

Expired certificates are among the most common SAML failures.

== SAML Configuration Verification ==

Display complete SAML configuration.

<nowiki>
show full-configuration user saml
</nowiki>

Verify carefully:

* entity-id
* single-sign-on-url
* single-logout-url
* idp-entity-id
* idp-single-sign-on-url
* idp-single-logout-url
* idp-cert
* digest-method
* group-name
* username
* clock tolerance

== SSL Inspection Considerations ==

If SSL inspection is enabled, verify that:

* Identity Provider traffic is excluded if necessary.
* Certificate substitution does not modify SAML exchanges.
* Browser trusts inspection certificates.

SSL inspection can invalidate SAML signatures.

== Clock Synchronization ==

SAML assertions are highly sensitive to time drift.

Verify system time.

<nowiki>
get system status
</nowiki>

Display NTP configuration.

<nowiki>
show system ntp
</nowiki>

Display synchronization status.

<nowiki>
diagnose sys ntp status
</nowiki>

Typical acceptable drift:

* Less than 60 seconds
* Ideally below 5 seconds

== Packet Capture ==

Capture HTTPS exchanges.

<nowiki>
diagnose sniffer packet any "host <IdP_IP>" 4 0 a
</nowiki>

Capture only TCP 443.

<nowiki>
diagnose sniffer packet any "tcp port 443" 4 0 a
</nowiki>

Capture only client traffic.

<nowiki>
diagnose sniffer packet any "host <client_ip>" 4 0 a
</nowiki>

== Flow Debugging ==

Enable flow tracing.

<nowiki>
diagnose debug reset
diagnose debug flow filter clear
diagnose debug flow show function-name enable
diagnose debug flow show iprope enable
diagnose debug flow trace start 100
diagnose debug enable
</nowiki>

Filter on client IP.

<nowiki>
diagnose debug flow filter addr <client_ip>
</nowiki>

Stop tracing.

<nowiki>
diagnose debug disable
diagnose debug reset
</nowiki>

== Browser Validation ==

Verify:

* Browser accepts cookies.
* Third-party cookies are not blocked.
* JavaScript is enabled.
* System clock is correct.
* Cached SAML cookies have been cleared.
* Private browsing has been tested.

== Identity Provider Validation ==

Verify:

* Metadata matches FortiGate configuration.
* ACS URL matches exactly.
* Entity ID matches.
* Signing certificate matches.
* NameID format is correct.
* User exists.
* User belongs to required groups.
* Required claims are issued.

== Assertion Validation ==

Verify:

* NameID exists.
* Audience matches SP Entity ID.
* Destination matches ACS URL.
* Assertion is signed.
* Signature validates.
* Assertion has not expired.
* User attributes exist.
* Group attributes exist.

== Security Concepts ==

=== Signature validation ===

Every SAML assertion should be digitally signed.

Unsigned assertions should never be accepted.

=== Certificate trust ===

Only trusted Identity Provider certificates should be configured.

Compromised certificates allow forged assertions.

=== Clock synchronization ===

Clock synchronization protects against replay attacks.

Incorrect clocks frequently generate:

* Assertion expired
* NotBefore failure
* Invalid Conditions

=== Metadata integrity ===

Always obtain metadata directly from the Identity Provider.

Avoid manual modifications whenever possible.

=== Least privilege ===

Only required groups should be mapped.

Avoid assigning administrative profiles to generic SAML groups.

=== HTTPS enforcement ===

All SAML exchanges should occur over HTTPS.

Plain HTTP exposes assertions to interception.

=== Replay protection ===

Each assertion should be:

* Time limited
* Single use
* Protected by TLS

== Common Debug Messages ==

=== Invalid Signature ===

Possible causes:

* Wrong IdP certificate
* Corrupted metadata
* SSL inspection
* Assertion modified

=== Invalid Audience ===

Verify:

* SP Entity ID
* Identity Provider metadata
* ACS URL

=== Invalid Destination ===

Usually caused by:

* Wrong ACS URL
* Reverse proxy modification
* Incorrect virtual hostname

=== No group attribute ===

Verify:

* Group claim issued
* Group attribute configured
* Group mapping configured

=== Assertion expired ===

Verify:

* NTP synchronization
* Browser clock
* Identity Provider clock

=== Unknown issuer ===

Verify:

* IdP Entity ID
* Metadata
* Signing certificate

== Troubleshooting ==

=== Endless login loop ===

Possible causes:

* ACS URL mismatch
* Cookie blocked
* SSL inspection
* Wrong Entity ID
* Invalid redirect URL

=== Authentication succeeds but VPN access denied ===

Verify:

* User group mapping
* Firewall policy
* SSL-VPN portal mapping
* Authentication rule order

=== User authenticated but no group assigned ===

Verify:

* Group claim
* Attribute name
* Case sensitivity
* IdP group mapping

=== Browser displays certificate error ===

Verify:

* Server certificate
* Intermediate CA
* Trusted Root CA
* Hostname

=== Login immediately fails ===

Verify:

* Metadata
* IdP certificate
* ACS URL
* Entity ID
* System time

=== Random authentication failures ===

Verify:

* NTP
* Load balancer persistence
* Multiple FortiGate HA synchronization
* Browser cache

=== Debug produces no output ===

Verify:

<nowiki>
diagnose debug enable
diagnose debug application samld -1
diagnose debug console timestamp enable
</nowiki>

Ensure authentication is attempted after enabling debugging.

== Useful Links ==

* https://docs.fortinet.com/
* https://community.fortinet.com/
* https://docs.fortinet.com/document/fortigate/latest/administration-guide
* https://docs.fortinet.com/document/fortigate/latest/cli-reference
* https://docs.fortinet.com/document/fortiauthenticator/latest/
* https://docs.fortinet.com/document/forticlient/latest/
* https://learn.microsoft.com/entra/identity/
* https://learn.microsoft.com/entra/identity/enterprise-apps/
* https://learn.microsoft.com/entra/identity-platform/
* https://help.okta.com/
* https://developer.okta.com/docs/guides/
* https://support.google.com/a/
* https://support.google.com/a/topic/24642
* https://www.keycloak.org/documentation
* https://wiki.shibboleth.net/
* https://docs.pingidentity.com/
* https://wiki.oasis-open.org/security/
* https://docs.oasis-open.org/security/saml/
* https://en.wikipedia.org/wiki/Security_Assertion_Markup_Language
* https://www.rfc-editor.org/

----

'''''[https://it-arts.net/index.php/Category:Wiki Return to Wiki Index]'''''