FORTIGATE - SAML Debug: Difference between revisions

From IT-Arts.net
Created page with "Category:Wiki '''''[https://it-arts.net/index.php/Category:Wiki Return to Wiki Index]''''' == Debug SAML Authentication == === Enable timestamped debugging === Enable timestamps before collecting any debug output to simplify correlation with client and identity provider logs. <nowiki> diagnose debug console timestamp enable diagnose debug reset diagnose debug application samld -1 diagnose debug enable </nowiki> === Disable debugging === Always disable debuggi..."
 
No edit summary
 
(4 intermediate revisions by the same user not shown)
Line 13: Line 13:
diagnose debug reset
diagnose debug reset
diagnose debug application samld -1
diagnose debug application samld -1
diagnose debug enable
diagnose debug application fnbamd -1
</nowiki>
diagnose debug enable</nowiki>


=== Disable debugging ===
=== Disable debugging ===
Line 22: Line 22:
  <nowiki>
  <nowiki>
diagnose debug disable
diagnose debug disable
diagnose debug reset
diagnose debug reset</nowiki>
</nowiki>


=== Enable verbose samld debugging ===
=== Verify SAML daemon activity ===


Display all SAML daemon messages.
Check that SAML daemon is actually processing authentication requests.
 
<nowiki>
diagnose debug application samld -1
</nowiki>
 
Higher verbosity is useful during:
 
* Initial SAML deployment
* Certificate validation failures
* Assertion parsing problems
* Group mapping verification
* Logout debugging
 
=== Filter debugging by process ===
 
Display currently running SAML daemon.


  <nowiki>
  <nowiki>
diagnose sys process pidof samld
diagnose sys process pidof samld
</nowiki>
diagnose sys top</nowiki>
 
Display process information.
 
<nowiki>
diagnose sys top
</nowiki>


== SAML Runtime Information ==
== SAML Runtime Information ==
Line 60: Line 37:


  <nowiki>
  <nowiki>
diagnose vpn ssl saml-session list
diagnose vpn ssl saml-session list</nowiki>
</nowiki>


Example:
Example:
Line 71: Line 47:
Portal    : full-access
Portal    : full-access
IdP        : AzureAD
IdP        : AzureAD
Login time : 2026-07-04 09:54:13
Login time : 2026-07-04 09:54:13</nowiki>
</nowiki>


=== Display active authenticated users ===
=== Display authenticated users ===


  <nowiki>
  <nowiki>
diagnose firewall auth list
diagnose firewall auth list</nowiki>
</nowiki>


Useful for verifying whether SAML authentication has been translated into a FortiGate authenticated user.
=== Display session table ===
 
=== Display user sessions ===


  <nowiki>
  <nowiki>
diagnose sys session list
diagnose sys session list</nowiki>
</nowiki>
 
Useful when troubleshooting SSL-VPN or explicit proxy authentication.


== SSL VPN Debugging ==
== SSL VPN Debugging (SAML + non-SAML) ==


=== Enable SSL-VPN debugging ===
=== Enable SSL VPN debug ===


  <nowiki>
  <nowiki>
diagnose debug application sslvpn -1
diagnose debug application sslvpn -1
diagnose debug enable
diagnose debug enable</nowiki>
</nowiki>


This displays:
=== View SSL VPN sessions ===


* Portal selection
<nowiki>
* Authentication process
get vpn ssl monitor</nowiki>
* SAML redirect
* Group assignment
* Tunnel establishment


=== Display SSL-VPN users ===
=== SSL VPN configuration check ===


  <nowiki>
  <nowiki>
get vpn ssl monitor
show vpn ssl settings</nowiki>
</nowiki>


=== Display SSL-VPN settings ===
== IPsec SAML / authentication context (important) ==


<nowiki>
SAML is typically used for SSL-VPN, but in IPsec environments authentication depends on mode:
show vpn ssl settings
</nowiki>


== Web Authentication Debugging ==
=== IPsec with username/password (FNBAMD path) ===


Display authentication daemon debugging.
Authentication is handled by fnbamd (same as SAML group mapping logic).


  <nowiki>
  <nowiki>
diagnose debug application fnbamd -1
diagnose debug application fnbamd -1
diagnose debug enable
diagnose debug application ike -1
</nowiki>
diagnose debug enable</nowiki>


Useful for:
== The IPsec Case ==


* Group lookup
=== IKE Gateway State (Primary Equivalent) ===
* User mapping
* LDAP interaction
* RADIUS interaction
* SAML user processing


== SAML Certificate Verification ==
This is the closest equivalent to “who is connected” in IPsec.


=== Display configured certificates ===
<nowiki>
diagnose vpn ike gateway list</nowiki>


<nowiki>
Provides:
show full-configuration vpn certificate local
* Peer IP address
</nowiki>
* Authentication method (PSK / certificate / EAP)
* IKE SA state (up/down)
* Negotiation status
* Lifetime information


Display CA certificates.
Use this as the primary “session-like” view for IPsec.


<nowiki>
=== IPsec Tunnel State (Data Plane View) ===
show full-configuration vpn certificate ca
</nowiki>


Display remote certificate information.
Shows active encrypted tunnels and traffic selectors.


  <nowiki>
  <nowiki>
get vpn certificate local
diagnose vpn tunnel list</nowiki>
</nowiki>


=== Verify expiration ===
Provides:
* Active Phase 2 SAs
* Encryption domains (subnets)
* SPI values
* Traffic counters
* Tunnel up/down state


Always verify:
This is equivalent to “active VPN data sessions”.


* IdP signing certificate
=== Summary View ===
* SP certificate
* Intermediate CA
* Root CA


Expired certificates are among the most common SAML failures.
Quick overview of active IPsec tunnels:
 
== SAML Configuration Verification ==
 
Display complete SAML configuration.


  <nowiki>
  <nowiki>
show full-configuration user saml
get vpn ipsec tunnel summary</nowiki>
</nowiki>
 
Verify carefully:
 
* entity-id
* single-sign-on-url
* single-logout-url
* idp-entity-id
* idp-single-sign-on-url
* idp-single-logout-url
* idp-cert
* digest-method
* group-name
* username
* clock tolerance
 
== SSL Inspection Considerations ==
 
If SSL inspection is enabled, verify that:
 
* Identity Provider traffic is excluded if necessary.
* Certificate substitution does not modify SAML exchanges.
* Browser trusts inspection certificates.
 
SSL inspection can invalidate SAML signatures.


== Clock Synchronization ==
Provides:
* Tunnel name
* Status (up/down)
* Quick health visibility


SAML assertions are highly sensitive to time drift.
=== User Identity in IPsec (When It Exists) ===


Verify system time.
IPsec only shows user identity when authentication is user-based.


<nowiki>
==== EAP / RADIUS / LDAP authentication ====
get system status
</nowiki>


Display NTP configuration.
In this case, identity is handled by fnbamd:


  <nowiki>
  <nowiki>
show system ntp
diagnose firewall auth list</nowiki>
</nowiki>


Display synchronization status.
or deeper inspection:


  <nowiki>
  <nowiki>
diagnose sys ntp status
diagnose debug application fnbamd -1</nowiki>
</nowiki>


Typical acceptable drift:
This may show:
* Username
* Group membership
* Authentication source
* Authorization result


* Less than 60 seconds
=== IPsec tunnel negotiation debugging ===
* Ideally below 5 seconds
 
== Packet Capture ==
 
Capture HTTPS exchanges.


  <nowiki>
  <nowiki>
diagnose sniffer packet any "host <IdP_IP>" 4 0 a
diagnose debug application ike -1
</nowiki>
diagnose vpn ike gateway list
diagnose vpn tunnel list</nowiki>


Capture only TCP 443.
=== Live IKE negotiation trace ===
 
<nowiki>
diagnose sniffer packet any "tcp port 443" 4 0 a
</nowiki>
 
Capture only client traffic.
 
<nowiki>
diagnose sniffer packet any "host <client_ip>" 4 0 a
</nowiki>
 
== Flow Debugging ==
 
Enable flow tracing.


  <nowiki>
  <nowiki>
diagnose debug console timestamp enable
diagnose debug reset
diagnose debug reset
diagnose debug flow filter clear
diagnose debug application ike -1
diagnose debug flow show function-name enable
diagnose debug enable</nowiki>
diagnose debug flow show iprope enable
diagnose debug flow trace start 100
diagnose debug enable
</nowiki>


Filter on client IP.
Filter by peer IP:


  <nowiki>
  <nowiki>
diagnose debug flow filter addr <client_ip>
diagnose vpn ike log-filter addr <peer_ip></nowiki>
</nowiki>


Stop tracing.
Stop debug:


  <nowiki>
  <nowiki>
diagnose debug disable
diagnose debug disable
diagnose debug reset
diagnose debug reset</nowiki>
</nowiki>


== Browser Validation ==
=== IPsec + SAML reality check ===


Verify:
SAML is NOT directly used in classic IPsec tunnels.


* Browser accepts cookies.
Instead:
* Third-party cookies are not blocked.
* JavaScript is enabled.
* System clock is correct.
* Cached SAML cookies have been cleared.
* Private browsing has been tested.


== Identity Provider Validation ==
* SSL-VPN → SAML supported natively
* IPsec dialup → usually LDAP/RADIUS or local users
* IPsec + external auth → goes through fnbamd, not samld


Verify:
So when troubleshooting IPsec login issues, focus on:


* Metadata matches FortiGate configuration.
* ike daemon
* ACS URL matches exactly.
* fnbamd daemon
* Entity ID matches.
* user/group mapping
* Signing certificate matches.
* NameID format is correct.
* User exists.
* User belongs to required groups.
* Required claims are issued.


== Assertion Validation ==
== Web authentication (shared backend) ==


Verify:
<nowiki>
diagnose debug application fnbamd -1
diagnose debug enable</nowiki>


* NameID exists.
Useful for:
* Audience matches SP Entity ID.
* Destination matches ACS URL.
* Assertion is signed.
* Signature validates.
* Assertion has not expired.
* User attributes exist.
* Group attributes exist.


== Security Concepts ==
* SAML group mapping
* LDAP / RADIUS fallback
* user identity resolution


=== Signature validation ===
== Certificates validation ==


Every SAML assertion should be digitally signed.
<nowiki>
show full-configuration vpn certificate local
show full-configuration vpn certificate ca</nowiki>


Unsigned assertions should never be accepted.
== Time synchronization (critical for SAML) ==


=== Certificate trust ===
<nowiki>
get system status
diagnose sys ntp status</nowiki>


Only trusted Identity Provider certificates should be configured.
== Packet capture (SAML / IPsec) ==


Compromised certificates allow forged assertions.
=== SAML / HTTPS ===


=== Clock synchronization ===
<nowiki>
diagnose sniffer packet any "host <idp_ip>" 4 0 a</nowiki>


Clock synchronization protects against replay attacks.
=== IPsec IKE ===


Incorrect clocks frequently generate:
<nowiki>
diagnose sniffer packet any "udp port 500 or udp port 4500" 4 0 a</nowiki>


* Assertion expired
== Flow debugging (authentication path) ==
* NotBefore failure
* Invalid Conditions


=== Metadata integrity ===
<nowiki>
diagnose debug reset
diagnose debug flow filter clear
diagnose debug flow show function-name enable
diagnose debug flow trace start 100
diagnose debug enable</nowiki>


Always obtain metadata directly from the Identity Provider.
Filter:


Avoid manual modifications whenever possible.
<nowiki>
diagnose debug flow filter addr <client_ip></nowiki>


=== Least privilege ===
Stop:


Only required groups should be mapped.
<nowiki>
diagnose debug disable
diagnose debug reset</nowiki>


Avoid assigning administrative profiles to generic SAML groups.
== Common failures ==


=== HTTPS enforcement ===
=== SAML login loop ===
* wrong ACS URL
* cookie blocked
* time drift
* wrong entity-id


All SAML exchanges should occur over HTTPS.
=== IPsec authentication fails ===
* wrong group mapping
* fnbamd rejection
* phase1 mismatch
* PSK mismatch (non-SAML case)


Plain HTTP exposes assertions to interception.
=== SAML works but no VPN access ===
* firewall policy missing
* group not mapped
* portal mismatch


=== Replay protection ===
=== No debug output ===
* forgot enable
* wrong daemon targeted
* authentication not triggered


Each assertion should be:
== Security concepts ==


* Time limited
=== Assertion integrity ===
* Single use
SAML must be signed and validated.
* Protected by TLS


== Common Debug Messages ==
=== Trust chain ===
Only trusted IdP certificates allowed.


=== Invalid Signature ===
=== Time validation ===
NTP drift breaks authentication.


Possible causes:
=== Least privilege ===
 
Map only required groups to VPN access.
* Wrong IdP certificate
* Corrupted metadata
* SSL inspection
* Assertion modified
 
=== Invalid Audience ===
 
Verify:
 
* SP Entity ID
* Identity Provider metadata
* ACS URL
 
=== Invalid Destination ===
 
Usually caused by:
 
* Wrong ACS URL
* Reverse proxy modification
* Incorrect virtual hostname
 
=== No group attribute ===
 
Verify:
 
* Group claim issued
* Group attribute configured
* Group mapping configured
 
=== Assertion expired ===
 
Verify:
 
* NTP synchronization
* Browser clock
* Identity Provider clock
 
=== Unknown issuer ===
 
Verify:
 
* IdP Entity ID
* Metadata
* Signing certificate
 
== Troubleshooting ==
 
=== Endless login loop ===
 
Possible causes:
 
* ACS URL mismatch
* Cookie blocked
* SSL inspection
* Wrong Entity ID
* Invalid redirect URL
 
=== Authentication succeeds but VPN access denied ===
 
Verify:
 
* User group mapping
* Firewall policy
* SSL-VPN portal mapping
* Authentication rule order
 
=== User authenticated but no group assigned ===
 
Verify:
 
* Group claim
* Attribute name
* Case sensitivity
* IdP group mapping
 
=== Browser displays certificate error ===
 
Verify:
 
* Server certificate
* Intermediate CA
* Trusted Root CA
* Hostname
 
=== Login immediately fails ===
 
Verify:
 
* Metadata
* IdP certificate
* ACS URL
* Entity ID
* System time
 
=== Random authentication failures ===
 
Verify:
 
* NTP
* Load balancer persistence
* Multiple FortiGate HA synchronization
* Browser cache
 
=== Debug produces no output ===
 
Verify:
 
<nowiki>
diagnose debug enable
diagnose debug application samld -1
diagnose debug console timestamp enable
</nowiki>
 
Ensure authentication is attempted after enabling debugging.


== Useful Links ==
== Useful links ==


* https://docs.fortinet.com/
* https://docs.fortinet.com/
Line 486: Line 300:
* https://docs.fortinet.com/document/fortigate/latest/administration-guide
* https://docs.fortinet.com/document/fortigate/latest/administration-guide
* https://docs.fortinet.com/document/fortigate/latest/cli-reference
* https://docs.fortinet.com/document/fortigate/latest/cli-reference
* https://docs.fortinet.com/document/fortiauthenticator/latest/
* https://docs.fortinet.com/document/forticlient/latest/
* https://learn.microsoft.com/entra/identity/
* https://learn.microsoft.com/entra/identity/
* https://learn.microsoft.com/entra/identity/enterprise-apps/
* https://wiki.oasis-open.org/security/saml
* https://learn.microsoft.com/entra/identity-platform/
* https://help.okta.com/
* https://developer.okta.com/docs/guides/
* https://support.google.com/a/
* https://support.google.com/a/topic/24642
* https://www.keycloak.org/documentation
* https://wiki.shibboleth.net/
* https://docs.pingidentity.com/
* https://wiki.oasis-open.org/security/
* https://docs.oasis-open.org/security/saml/
* https://en.wikipedia.org/wiki/Security_Assertion_Markup_Language
* https://www.rfc-editor.org/


----
----


'''''[https://it-arts.net/index.php/Category:Wiki Return to Wiki Index]'''''
'''''[https://it-arts.net/index.php/Category:Wiki Return to Wiki Index]'''''

Latest revision as of 06:56, 6 July 2026


Return to Wiki Index

Debug SAML Authentication

Enable timestamped debugging

Enable timestamps before collecting any debug output to simplify correlation with client and identity provider logs. 

diagnose debug console timestamp enable
diagnose debug reset
diagnose debug application samld -1
diagnose debug application fnbamd -1
diagnose debug enable

Disable debugging

Always disable debugging after troubleshooting to avoid unnecessary CPU usage and excessive log generation. 

diagnose debug disable
diagnose debug reset

Verify SAML daemon activity

Check that SAML daemon is actually processing authentication requests. 

diagnose sys process pidof samld
diagnose sys top

SAML Runtime Information

Display current SAML sessions

diagnose vpn ssl saml-session list

Example: 

Session ID : 9
User       : john.doe
Group      : VPN_Users
Portal     : full-access
IdP        : AzureAD
Login time : 2026-07-04 09:54:13

Display authenticated users

diagnose firewall auth list

Display session table

diagnose sys session list

SSL VPN Debugging (SAML + non-SAML)

Enable SSL VPN debug

diagnose debug application sslvpn -1
diagnose debug enable

View SSL VPN sessions

get vpn ssl monitor

SSL VPN configuration check

show vpn ssl settings

IPsec SAML / authentication context (important)

SAML is typically used for SSL-VPN, but in IPsec environments authentication depends on mode:

IPsec with username/password (FNBAMD path)

Authentication is handled by fnbamd (same as SAML group mapping logic). 

diagnose debug application fnbamd -1
diagnose debug application ike -1
diagnose debug enable

The IPsec Case

IKE Gateway State (Primary Equivalent)

This is the closest equivalent to “who is connected” in IPsec. 

diagnose vpn ike gateway list

Provides:

  • Peer IP address
  • Authentication method (PSK / certificate / EAP)
  • IKE SA state (up/down)
  • Negotiation status
  • Lifetime information

Use this as the primary “session-like” view for IPsec.

IPsec Tunnel State (Data Plane View)

Shows active encrypted tunnels and traffic selectors. 

diagnose vpn tunnel list

Provides:

  • Active Phase 2 SAs
  • Encryption domains (subnets)
  • SPI values
  • Traffic counters
  • Tunnel up/down state

This is equivalent to “active VPN data sessions”.

Summary View

Quick overview of active IPsec tunnels: 

get vpn ipsec tunnel summary

Provides:

  • Tunnel name
  • Status (up/down)
  • Quick health visibility

User Identity in IPsec (When It Exists)

IPsec only shows user identity when authentication is user-based.

EAP / RADIUS / LDAP authentication

In this case, identity is handled by fnbamd: 

diagnose firewall auth list

or deeper inspection: 

diagnose debug application fnbamd -1

This may show:

  • Username
  • Group membership
  • Authentication source
  • Authorization result

IPsec tunnel negotiation debugging

diagnose debug application ike -1
diagnose vpn ike gateway list
diagnose vpn tunnel list

Live IKE negotiation trace

diagnose debug console timestamp enable
diagnose debug reset
diagnose debug application ike -1
diagnose debug enable

Filter by peer IP: 

diagnose vpn ike log-filter addr <peer_ip>

Stop debug: 

diagnose debug disable
diagnose debug reset

IPsec + SAML reality check

SAML is NOT directly used in classic IPsec tunnels.

Instead:

  • SSL-VPN → SAML supported natively
  • IPsec dialup → usually LDAP/RADIUS or local users
  • IPsec + external auth → goes through fnbamd, not samld

So when troubleshooting IPsec login issues, focus on:

  • ike daemon
  • fnbamd daemon
  • user/group mapping

Web authentication (shared backend)

diagnose debug application fnbamd -1
diagnose debug enable

Useful for:

  • SAML group mapping
  • LDAP / RADIUS fallback
  • user identity resolution

Certificates validation

show full-configuration vpn certificate local
show full-configuration vpn certificate ca

Time synchronization (critical for SAML)

get system status
diagnose sys ntp status

Packet capture (SAML / IPsec)

SAML / HTTPS

diagnose sniffer packet any "host <idp_ip>" 4 0 a

IPsec IKE

diagnose sniffer packet any "udp port 500 or udp port 4500" 4 0 a

Flow debugging (authentication path)

diagnose debug reset
diagnose debug flow filter clear
diagnose debug flow show function-name enable
diagnose debug flow trace start 100
diagnose debug enable

Filter: 

diagnose debug flow filter addr <client_ip>

Stop: 

diagnose debug disable
diagnose debug reset

Common failures

SAML login loop

  • wrong ACS URL
  • cookie blocked
  • time drift
  • wrong entity-id

IPsec authentication fails

  • wrong group mapping
  • fnbamd rejection
  • phase1 mismatch
  • PSK mismatch (non-SAML case)

SAML works but no VPN access

  • firewall policy missing
  • group not mapped
  • portal mismatch

No debug output

  • forgot enable
  • wrong daemon targeted
  • authentication not triggered

Security concepts

Assertion integrity

SAML must be signed and validated.

Trust chain

Only trusted IdP certificates allowed.

Time validation

NTP drift breaks authentication.

Least privilege

Map only required groups to VPN access.

Return to Wiki Index

Retrieved from "https://it-arts.net/index.php?title=FORTIGATE_-_SAML_Debug&oldid=1201"