FORTIGATE - SAML Debug: Difference between revisions

From IT-Arts.net
Newer edit →
Created page with "Category:Wiki '''''[https://it-arts.net/index.php/Category:Wiki Return to Wiki Index]''''' == Debug SAML Authentication == === Enable timestamped debugging === Enable timestamps before collecting any debug output to simplify correlation with client and identity provider logs. <nowiki> diagnose debug console timestamp enable diagnose debug reset diagnose debug application samld -1 diagnose debug enable </nowiki> === Disable debugging === Always disable debuggi..."
 
No edit summary
Line 1: Line 1:
[[Category:Wiki]]
'''''[https://it-arts.net/index.php/Category:Wiki Return to Wiki Index]'''''
[[Category:Wiki]]
[[Category:Wiki]]


Line 9: Line 12:
Enable timestamps before collecting any debug output to simplify correlation with client and identity provider logs.
Enable timestamps before collecting any debug output to simplify correlation with client and identity provider logs.


<nowiki>
<nowiki>
diagnose debug console timestamp enable
diagnose debug console timestamp enable
diagnose debug reset
diagnose debug reset
diagnose debug application samld -1
diagnose debug application samld -1
diagnose debug enable
diagnose debug application fnbamd -1
</nowiki>
diagnose debug enable</nowiki>


=== Disable debugging ===
=== Disable debugging ===
Line 20: Line 23:
Always disable debugging after troubleshooting to avoid unnecessary CPU usage and excessive log generation.
Always disable debugging after troubleshooting to avoid unnecessary CPU usage and excessive log generation.


<nowiki>
<nowiki>
diagnose debug disable
diagnose debug disable
diagnose debug reset
diagnose debug reset</nowiki>
</nowiki>


=== Enable verbose samld debugging ===
=== Verify SAML daemon activity ===


Display all SAML daemon messages.
Check that SAML daemon is actually processing authentication requests.


<nowiki>
<nowiki>
diagnose debug application samld -1
</nowiki>
 
Higher verbosity is useful during:
 
* Initial SAML deployment
* Certificate validation failures
* Assertion parsing problems
* Group mapping verification
* Logout debugging
 
=== Filter debugging by process ===
 
Display currently running SAML daemon.
 
<nowiki>
diagnose sys process pidof samld
diagnose sys process pidof samld
</nowiki>
diagnose sys top</nowiki>
 
Display process information.
 
<nowiki>
diagnose sys top
</nowiki>


== SAML Runtime Information ==
== SAML Runtime Information ==
Line 59: Line 39:
=== Display current SAML sessions ===
=== Display current SAML sessions ===


<nowiki>
<nowiki>
diagnose vpn ssl saml-session list
diagnose vpn ssl saml-session list</nowiki>
</nowiki>


Example:
Example:


<nowiki>
<nowiki>
Session ID : 9
Session ID : 9
User      : john.doe
User      : john.doe
Line 71: Line 50:
Portal    : full-access
Portal    : full-access
IdP        : AzureAD
IdP        : AzureAD
Login time : 2026-07-04 09:54:13
Login time : 2026-07-04 09:54:13</nowiki>
</nowiki>
 
=== Display active authenticated users ===
 
<nowiki>
diagnose firewall auth list
</nowiki>


Useful for verifying whether SAML authentication has been translated into a FortiGate authenticated user.
=== Display authenticated users ===


=== Display user sessions ===
<nowiki>
diagnose firewall auth list</nowiki>


<nowiki>
=== Display session table ===
diagnose sys session list
</nowiki>


Useful when troubleshooting SSL-VPN or explicit proxy authentication.
<nowiki>
diagnose sys session list</nowiki>


== SSL VPN Debugging ==
== SSL VPN Debugging (SAML + non-SAML) ==


=== Enable SSL-VPN debugging ===
=== Enable SSL VPN debug ===


<nowiki>
<nowiki>
diagnose debug application sslvpn -1
diagnose debug application sslvpn -1
diagnose debug enable
diagnose debug enable</nowiki>
</nowiki>


This displays:
=== View SSL VPN sessions ===


* Portal selection
<nowiki>
* Authentication process
get vpn ssl monitor</nowiki>
* SAML redirect
* Group assignment
* Tunnel establishment


=== Display SSL-VPN users ===
=== SSL VPN configuration check ===


<nowiki>
<nowiki>
get vpn ssl monitor
show vpn ssl settings</nowiki>
</nowiki>


=== Display SSL-VPN settings ===
== IPsec SAML / authentication context (important) ==


<nowiki>
SAML is typically used for SSL-VPN, but in IPsec environments authentication depends on mode:
show vpn ssl settings
</nowiki>


== Web Authentication Debugging ==
=== IPsec with username/password (FNBAMD path) ===


Display authentication daemon debugging.
Authentication is handled by fnbamd (same as SAML group mapping logic).


<nowiki>
<nowiki>
diagnose debug application fnbamd -1
diagnose debug application fnbamd -1
diagnose debug enable
diagnose debug application ike -1
</nowiki>
diagnose debug enable</nowiki>


Useful for:
=== IPsec tunnel negotiation debugging ===


* Group lookup
<nowiki>
* User mapping
diagnose debug application ike -1
* LDAP interaction
diagnose vpn ike gateway list
* RADIUS interaction
diagnose vpn tunnel list</nowiki>
* SAML user processing


== SAML Certificate Verification ==
=== Live IKE negotiation trace ===


=== Display configured certificates ===
<nowiki>
diagnose debug console timestamp enable
diagnose debug reset
diagnose debug application ike -1
diagnose debug enable</nowiki>


<nowiki>
Filter by peer IP:
show full-configuration vpn certificate local
</nowiki>


Display CA certificates.
<nowiki>
diagnose vpn ike log-filter addr <peer_ip></nowiki>


<nowiki>
Stop debug:
show full-configuration vpn certificate ca
</nowiki>


Display remote certificate information.
<nowiki>
diagnose debug disable
diagnose debug reset</nowiki>


<nowiki>
=== IPsec + SAML reality check ===
get vpn certificate local
</nowiki>


=== Verify expiration ===
SAML is NOT directly used in classic IPsec tunnels.


Always verify:
Instead:


* IdP signing certificate
* SSL-VPN → SAML supported natively
* SP certificate
* IPsec dialup → usually LDAP/RADIUS or local users
* Intermediate CA
* IPsec + external auth → goes through fnbamd, not samld
* Root CA


Expired certificates are among the most common SAML failures.
So when troubleshooting IPsec login issues, focus on:


== SAML Configuration Verification ==
* ike daemon
* fnbamd daemon
* user/group mapping


Display complete SAML configuration.
== Web authentication (shared backend) ==


<nowiki>
<nowiki>
show full-configuration user saml
diagnose debug application fnbamd -1
</nowiki>
diagnose debug enable</nowiki>


Verify carefully:
Useful for:


* entity-id
* SAML group mapping
* single-sign-on-url
* LDAP / RADIUS fallback
* single-logout-url
* user identity resolution
* idp-entity-id
* idp-single-sign-on-url
* idp-single-logout-url
* idp-cert
* digest-method
* group-name
* username
* clock tolerance


== SSL Inspection Considerations ==
== Certificates validation ==


If SSL inspection is enabled, verify that:
<nowiki>
 
show full-configuration vpn certificate local
* Identity Provider traffic is excluded if necessary.
show full-configuration vpn certificate ca</nowiki>
* Certificate substitution does not modify SAML exchanges.
* Browser trusts inspection certificates.
 
SSL inspection can invalidate SAML signatures.
 
== Clock Synchronization ==


SAML assertions are highly sensitive to time drift.
== Time synchronization (critical for SAML) ==


Verify system time.
<nowiki>
 
<nowiki>
get system status
get system status
</nowiki>
diagnose sys ntp status</nowiki>
 
Display NTP configuration.
 
<nowiki>
show system ntp
</nowiki>
 
Display synchronization status.
 
<nowiki>
diagnose sys ntp status
</nowiki>


Typical acceptable drift:
== Packet capture (SAML / IPsec) ==


* Less than 60 seconds
=== SAML / HTTPS ===
* Ideally below 5 seconds


== Packet Capture ==
<nowiki>
diagnose sniffer packet any "host <idp_ip>" 4 0 a</nowiki>


Capture HTTPS exchanges.
=== IPsec IKE ===


<nowiki>
<nowiki>
diagnose sniffer packet any "host <IdP_IP>" 4 0 a
diagnose sniffer packet any "udp port 500 or udp port 4500" 4 0 a</nowiki>
</nowiki>


Capture only TCP 443.
== Flow debugging (authentication path) ==


<nowiki>
<nowiki>
diagnose sniffer packet any "tcp port 443" 4 0 a
</nowiki>
 
Capture only client traffic.
 
<nowiki>
diagnose sniffer packet any "host <client_ip>" 4 0 a
</nowiki>
 
== Flow Debugging ==
 
Enable flow tracing.
 
<nowiki>
diagnose debug reset
diagnose debug reset
diagnose debug flow filter clear
diagnose debug flow filter clear
diagnose debug flow show function-name enable
diagnose debug flow show function-name enable
diagnose debug flow show iprope enable
diagnose debug flow trace start 100
diagnose debug flow trace start 100
diagnose debug enable
diagnose debug enable</nowiki>
</nowiki>


Filter on client IP.
Filter:


<nowiki>
<nowiki>
diagnose debug flow filter addr <client_ip>
diagnose debug flow filter addr <client_ip></nowiki>
</nowiki>


Stop tracing.
Stop:


<nowiki>
<nowiki>
diagnose debug disable
diagnose debug disable
diagnose debug reset
diagnose debug reset</nowiki>
</nowiki>
 
== Browser Validation ==
 
Verify:
 
* Browser accepts cookies.
* Third-party cookies are not blocked.
* JavaScript is enabled.
* System clock is correct.
* Cached SAML cookies have been cleared.
* Private browsing has been tested.
 
== Identity Provider Validation ==
 
Verify:
 
* Metadata matches FortiGate configuration.
* ACS URL matches exactly.
* Entity ID matches.
* Signing certificate matches.
* NameID format is correct.
* User exists.
* User belongs to required groups.
* Required claims are issued.
 
== Assertion Validation ==


Verify:
== Common failures ==


* NameID exists.
=== SAML login loop ===
* Audience matches SP Entity ID.
* wrong ACS URL
* Destination matches ACS URL.
* cookie blocked
* Assertion is signed.
* time drift
* Signature validates.
* wrong entity-id
* Assertion has not expired.
* User attributes exist.
* Group attributes exist.


== Security Concepts ==
=== IPsec authentication fails ===
* wrong group mapping
* fnbamd rejection
* phase1 mismatch
* PSK mismatch (non-SAML case)


=== Signature validation ===
=== SAML works but no VPN access ===
* firewall policy missing
* group not mapped
* portal mismatch


Every SAML assertion should be digitally signed.
=== No debug output ===
* forgot enable
* wrong daemon targeted
* authentication not triggered


Unsigned assertions should never be accepted.
== Security concepts ==


=== Certificate trust ===
=== Assertion integrity ===
SAML must be signed and validated.


Only trusted Identity Provider certificates should be configured.
=== Trust chain ===
Only trusted IdP certificates allowed.


Compromised certificates allow forged assertions.
=== Time validation ===
 
NTP drift breaks authentication.
=== Clock synchronization ===
 
Clock synchronization protects against replay attacks.
 
Incorrect clocks frequently generate:
 
* Assertion expired
* NotBefore failure
* Invalid Conditions
 
=== Metadata integrity ===
 
Always obtain metadata directly from the Identity Provider.
 
Avoid manual modifications whenever possible.


=== Least privilege ===
=== Least privilege ===
Map only required groups to VPN access.


Only required groups should be mapped.
== Useful links ==
 
Avoid assigning administrative profiles to generic SAML groups.
 
=== HTTPS enforcement ===
 
All SAML exchanges should occur over HTTPS.
 
Plain HTTP exposes assertions to interception.
 
=== Replay protection ===
 
Each assertion should be:
 
* Time limited
* Single use
* Protected by TLS
 
== Common Debug Messages ==
 
=== Invalid Signature ===
 
Possible causes:
 
* Wrong IdP certificate
* Corrupted metadata
* SSL inspection
* Assertion modified
 
=== Invalid Audience ===
 
Verify:
 
* SP Entity ID
* Identity Provider metadata
* ACS URL
 
=== Invalid Destination ===
 
Usually caused by:
 
* Wrong ACS URL
* Reverse proxy modification
* Incorrect virtual hostname
 
=== No group attribute ===
 
Verify:
 
* Group claim issued
* Group attribute configured
* Group mapping configured
 
=== Assertion expired ===
 
Verify:
 
* NTP synchronization
* Browser clock
* Identity Provider clock
 
=== Unknown issuer ===
 
Verify:
 
* IdP Entity ID
* Metadata
* Signing certificate
 
== Troubleshooting ==
 
=== Endless login loop ===
 
Possible causes:
 
* ACS URL mismatch
* Cookie blocked
* SSL inspection
* Wrong Entity ID
* Invalid redirect URL
 
=== Authentication succeeds but VPN access denied ===
 
Verify:
 
* User group mapping
* Firewall policy
* SSL-VPN portal mapping
* Authentication rule order
 
=== User authenticated but no group assigned ===
 
Verify:
 
* Group claim
* Attribute name
* Case sensitivity
* IdP group mapping
 
=== Browser displays certificate error ===
 
Verify:
 
* Server certificate
* Intermediate CA
* Trusted Root CA
* Hostname
 
=== Login immediately fails ===
 
Verify:
 
* Metadata
* IdP certificate
* ACS URL
* Entity ID
* System time
 
=== Random authentication failures ===
 
Verify:
 
* NTP
* Load balancer persistence
* Multiple FortiGate HA synchronization
* Browser cache
 
=== Debug produces no output ===
 
Verify:
 
<nowiki>
diagnose debug enable
diagnose debug application samld -1
diagnose debug console timestamp enable
</nowiki>
 
Ensure authentication is attempted after enabling debugging.
 
== Useful Links ==


* https://docs.fortinet.com/
* https://docs.fortinet.com/
Line 486: Line 235:
* https://docs.fortinet.com/document/fortigate/latest/administration-guide
* https://docs.fortinet.com/document/fortigate/latest/administration-guide
* https://docs.fortinet.com/document/fortigate/latest/cli-reference
* https://docs.fortinet.com/document/fortigate/latest/cli-reference
* https://docs.fortinet.com/document/fortiauthenticator/latest/
* https://docs.fortinet.com/document/forticlient/latest/
* https://learn.microsoft.com/entra/identity/
* https://learn.microsoft.com/entra/identity/
* https://learn.microsoft.com/entra/identity/enterprise-apps/
* https://wiki.oasis-open.org/security/saml
* https://learn.microsoft.com/entra/identity-platform/
 
* https://help.okta.com/
----
* https://developer.okta.com/docs/guides/
 
* https://support.google.com/a/
'''''[https://it-arts.net/index.php/Category:Wiki Return to Wiki Index]'''''
* https://support.google.com/a/topic/24642
* https://www.keycloak.org/documentation
* https://wiki.shibboleth.net/
* https://docs.pingidentity.com/
* https://wiki.oasis-open.org/security/
* https://docs.oasis-open.org/security/saml/
* https://en.wikipedia.org/wiki/Security_Assertion_Markup_Language
* https://www.rfc-editor.org/


----
----


'''''[https://it-arts.net/index.php/Category:Wiki Return to Wiki Index]'''''
'''''[https://it-arts.net/index.php/Category:Wiki Return to Wiki Index]'''''

Revision as of 06:23, 6 July 2026


Return to Wiki Index

Return to Wiki Index

Debug SAML Authentication

Enable timestamped debugging

Enable timestamps before collecting any debug output to simplify correlation with client and identity provider logs.

diagnose debug console timestamp enable diagnose debug reset diagnose debug application samld -1 diagnose debug application fnbamd -1 diagnose debug enable

Disable debugging

Always disable debugging after troubleshooting to avoid unnecessary CPU usage and excessive log generation.

diagnose debug disable diagnose debug reset

Verify SAML daemon activity

Check that SAML daemon is actually processing authentication requests.

diagnose sys process pidof samld diagnose sys top

SAML Runtime Information

Display current SAML sessions

diagnose vpn ssl saml-session list

Example:

Session ID : 9 User  : john.doe Group  : VPN_Users Portal  : full-access IdP  : AzureAD Login time : 2026-07-04 09:54:13

Display authenticated users

diagnose firewall auth list

Display session table

diagnose sys session list

SSL VPN Debugging (SAML + non-SAML)

Enable SSL VPN debug

diagnose debug application sslvpn -1 diagnose debug enable

View SSL VPN sessions

get vpn ssl monitor

SSL VPN configuration check

show vpn ssl settings

IPsec SAML / authentication context (important)

SAML is typically used for SSL-VPN, but in IPsec environments authentication depends on mode:

IPsec with username/password (FNBAMD path)

Authentication is handled by fnbamd (same as SAML group mapping logic).

diagnose debug application fnbamd -1 diagnose debug application ike -1 diagnose debug enable

IPsec tunnel negotiation debugging

diagnose debug application ike -1 diagnose vpn ike gateway list diagnose vpn tunnel list

Live IKE negotiation trace

diagnose debug console timestamp enable diagnose debug reset diagnose debug application ike -1 diagnose debug enable

Filter by peer IP:

diagnose vpn ike log-filter addr <peer_ip>

Stop debug:

diagnose debug disable diagnose debug reset

IPsec + SAML reality check

SAML is NOT directly used in classic IPsec tunnels.

Instead:

  • SSL-VPN → SAML supported natively
  • IPsec dialup → usually LDAP/RADIUS or local users
  • IPsec + external auth → goes through fnbamd, not samld

So when troubleshooting IPsec login issues, focus on:

  • ike daemon
  • fnbamd daemon
  • user/group mapping

Web authentication (shared backend)

diagnose debug application fnbamd -1 diagnose debug enable

Useful for:

  • SAML group mapping
  • LDAP / RADIUS fallback
  • user identity resolution

Certificates validation

show full-configuration vpn certificate local show full-configuration vpn certificate ca

Time synchronization (critical for SAML)

get system status diagnose sys ntp status

Packet capture (SAML / IPsec)

SAML / HTTPS

diagnose sniffer packet any "host <idp_ip>" 4 0 a

IPsec IKE

diagnose sniffer packet any "udp port 500 or udp port 4500" 4 0 a

Flow debugging (authentication path)

diagnose debug reset diagnose debug flow filter clear diagnose debug flow show function-name enable diagnose debug flow trace start 100 diagnose debug enable

Filter:

diagnose debug flow filter addr <client_ip>

Stop:

diagnose debug disable diagnose debug reset

Common failures

SAML login loop

  • wrong ACS URL
  • cookie blocked
  • time drift
  • wrong entity-id

IPsec authentication fails

  • wrong group mapping
  • fnbamd rejection
  • phase1 mismatch
  • PSK mismatch (non-SAML case)

SAML works but no VPN access

  • firewall policy missing
  • group not mapped
  • portal mismatch

No debug output

  • forgot enable
  • wrong daemon targeted
  • authentication not triggered

Security concepts

Assertion integrity

SAML must be signed and validated.

Trust chain

Only trusted IdP certificates allowed.

Time validation

NTP drift breaks authentication.

Least privilege

Map only required groups to VPN access.

Return to Wiki Index

Return to Wiki Index

Retrieved from "https://it-arts.net/index.php?title=FORTIGATE_-_SAML_Debug&oldid=1197"