FORTIGATE - SAML Debug

From IT-Arts.net
Revision as of 05:44, 6 July 2026 by Admin (talk | contribs) (Created page with "Category:Wiki '''''[https://it-arts.net/index.php/Category:Wiki Return to Wiki Index]''''' == Debug SAML Authentication == === Enable timestamped debugging === Enable timestamps before collecting any debug output to simplify correlation with client and identity provider logs. <nowiki> diagnose debug console timestamp enable diagnose debug reset diagnose debug application samld -1 diagnose debug enable </nowiki> === Disable debugging === Always disable debuggi...")
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)


Return to Wiki Index

Debug SAML Authentication

Enable timestamped debugging

Enable timestamps before collecting any debug output to simplify correlation with client and identity provider logs. 

diagnose debug console timestamp enable
diagnose debug reset
diagnose debug application samld -1
diagnose debug enable

Disable debugging

Always disable debugging after troubleshooting to avoid unnecessary CPU usage and excessive log generation. 

diagnose debug disable
diagnose debug reset

Enable verbose samld debugging

Display all SAML daemon messages. 

diagnose debug application samld -1

Higher verbosity is useful during:

  • Initial SAML deployment
  • Certificate validation failures
  • Assertion parsing problems
  • Group mapping verification
  • Logout debugging

Filter debugging by process

Display currently running SAML daemon. 

diagnose sys process pidof samld

Display process information. 

diagnose sys top

SAML Runtime Information

Display current SAML sessions

diagnose vpn ssl saml-session list

Example: 

Session ID : 9
User       : john.doe
Group      : VPN_Users
Portal     : full-access
IdP        : AzureAD
Login time : 2026-07-04 09:54:13

Display active authenticated users

diagnose firewall auth list

Useful for verifying whether SAML authentication has been translated into a FortiGate authenticated user.

Display user sessions

diagnose sys session list

Useful when troubleshooting SSL-VPN or explicit proxy authentication.

SSL VPN Debugging

Enable SSL-VPN debugging

diagnose debug application sslvpn -1
diagnose debug enable

This displays:

  • Portal selection
  • Authentication process
  • SAML redirect
  • Group assignment
  • Tunnel establishment

Display SSL-VPN users

get vpn ssl monitor

Display SSL-VPN settings

show vpn ssl settings

Web Authentication Debugging

Display authentication daemon debugging. 

diagnose debug application fnbamd -1
diagnose debug enable

Useful for:

  • Group lookup
  • User mapping
  • LDAP interaction
  • RADIUS interaction
  • SAML user processing

SAML Certificate Verification

Display configured certificates

show full-configuration vpn certificate local

Display CA certificates. 

show full-configuration vpn certificate ca

Display remote certificate information. 

get vpn certificate local

Verify expiration

Always verify:

  • IdP signing certificate
  • SP certificate
  • Intermediate CA
  • Root CA

Expired certificates are among the most common SAML failures.

SAML Configuration Verification

Display complete SAML configuration. 

show full-configuration user saml

Verify carefully:

  • entity-id
  • single-sign-on-url
  • single-logout-url
  • idp-entity-id
  • idp-single-sign-on-url
  • idp-single-logout-url
  • idp-cert
  • digest-method
  • group-name
  • username
  • clock tolerance

SSL Inspection Considerations

If SSL inspection is enabled, verify that:

  • Identity Provider traffic is excluded if necessary.
  • Certificate substitution does not modify SAML exchanges.
  • Browser trusts inspection certificates.

SSL inspection can invalidate SAML signatures.

Clock Synchronization

SAML assertions are highly sensitive to time drift.

Verify system time. 

get system status

Display NTP configuration. 

show system ntp

Display synchronization status. 

diagnose sys ntp status

Typical acceptable drift:

  • Less than 60 seconds
  • Ideally below 5 seconds

Packet Capture

Capture HTTPS exchanges. 

diagnose sniffer packet any "host <IdP_IP>" 4 0 a

Capture only TCP 443. 

diagnose sniffer packet any "tcp port 443" 4 0 a

Capture only client traffic. 

diagnose sniffer packet any "host <client_ip>" 4 0 a

Flow Debugging

Enable flow tracing. 

diagnose debug reset
diagnose debug flow filter clear
diagnose debug flow show function-name enable
diagnose debug flow show iprope enable
diagnose debug flow trace start 100
diagnose debug enable

Filter on client IP. 

diagnose debug flow filter addr <client_ip>

Stop tracing. 

diagnose debug disable
diagnose debug reset

Browser Validation

Verify:

  • Browser accepts cookies.
  • Third-party cookies are not blocked.
  • JavaScript is enabled.
  • System clock is correct.
  • Cached SAML cookies have been cleared.
  • Private browsing has been tested.

Identity Provider Validation

Verify:

  • Metadata matches FortiGate configuration.
  • ACS URL matches exactly.
  • Entity ID matches.
  • Signing certificate matches.
  • NameID format is correct.
  • User exists.
  • User belongs to required groups.
  • Required claims are issued.

Assertion Validation

Verify:

  • NameID exists.
  • Audience matches SP Entity ID.
  • Destination matches ACS URL.
  • Assertion is signed.
  • Signature validates.
  • Assertion has not expired.
  • User attributes exist.
  • Group attributes exist.

Security Concepts

Signature validation

Every SAML assertion should be digitally signed.

Unsigned assertions should never be accepted.

Certificate trust

Only trusted Identity Provider certificates should be configured.

Compromised certificates allow forged assertions.

Clock synchronization

Clock synchronization protects against replay attacks.

Incorrect clocks frequently generate:

  • Assertion expired
  • NotBefore failure
  • Invalid Conditions

Metadata integrity

Always obtain metadata directly from the Identity Provider.

Avoid manual modifications whenever possible.

Least privilege

Only required groups should be mapped.

Avoid assigning administrative profiles to generic SAML groups.

HTTPS enforcement

All SAML exchanges should occur over HTTPS.

Plain HTTP exposes assertions to interception.

Replay protection

Each assertion should be:

  • Time limited
  • Single use
  • Protected by TLS

Common Debug Messages

Invalid Signature

Possible causes:

  • Wrong IdP certificate
  • Corrupted metadata
  • SSL inspection
  • Assertion modified

Invalid Audience

Verify:

  • SP Entity ID
  • Identity Provider metadata
  • ACS URL

Invalid Destination

Usually caused by:

  • Wrong ACS URL
  • Reverse proxy modification
  • Incorrect virtual hostname

No group attribute

Verify:

  • Group claim issued
  • Group attribute configured
  • Group mapping configured

Assertion expired

Verify:

  • NTP synchronization
  • Browser clock
  • Identity Provider clock

Unknown issuer

Verify:

  • IdP Entity ID
  • Metadata
  • Signing certificate

Troubleshooting

Endless login loop

Possible causes:

  • ACS URL mismatch
  • Cookie blocked
  • SSL inspection
  • Wrong Entity ID
  • Invalid redirect URL

Authentication succeeds but VPN access denied

Verify:

  • User group mapping
  • Firewall policy
  • SSL-VPN portal mapping
  • Authentication rule order

User authenticated but no group assigned

Verify:

  • Group claim
  • Attribute name
  • Case sensitivity
  • IdP group mapping

Browser displays certificate error

Verify:

  • Server certificate
  • Intermediate CA
  • Trusted Root CA
  • Hostname

Login immediately fails

Verify:

  • Metadata
  • IdP certificate
  • ACS URL
  • Entity ID
  • System time

Random authentication failures

Verify:

  • NTP
  • Load balancer persistence
  • Multiple FortiGate HA synchronization
  • Browser cache

Debug produces no output

Verify: 

diagnose debug enable
diagnose debug application samld -1
diagnose debug console timestamp enable

Ensure authentication is attempted after enabling debugging.

Return to Wiki Index

Retrieved from "https://it-arts.net/index.php?title=FORTIGATE_-_SAML_Debug&oldid=1196"