Tag Archives: Microsoft

Fixing SAML Authentication Failure After FortiGate Upgrade with Microsoft Entra ID – Firewall Authentication Failed

A quick post on what broke after a FortiGate firmware upgrade—and the one setting that fixed it.

After upgrading a FortiGate firewall to the latest firmware, I ran into an unexpected problem:
SAML authentication suddenly stopped working for users signing in via
Microsoft Entra ID (formerly Azure AD). The configuration looked intact—certificates were present,
the SAML setup was unchanged—yet logins kept failing.
Forticlient users, will get Firewall Authentication Failed



It wasn’t a lost configuration or a certificate mismatch. It turned out to be a change in
how SAML assertions are validated in the newest FortiGate versions when
Microsoft Entra ID is the Identity Provider (IdP).

The Root Cause
The latest FortiGate firmware expects the IdP to sign both the SAML response and the SAML assertion.
If your Entra ID configuration only signs the response (which used to be sufficient), authentication will fail
after the upgrade.

The Fix (Microsoft Entra ID setting)

  • Open the Microsoft Entra admin center and go to your Enterprise application for FortiGate.
  • Navigate to Single sign-on → SAML Certificates → SAML Signing Certificate → Edit.
  • Under Signing option, select: Sign SAML response and assertion.
  • Save the change and test authentication again.
  • Once this option was enabled, users were able to authenticate successfully again.

    Why This Matters
    Requiring signatures on both the response and the assertion strengthens the integrity of the SAML flow:
    FortiGate can verify not only the envelope (response) but also the identity claims (assertion).
    This improves security, but it may catch existing deployments by surprise after an upgrade.

    Takeaway

    • If SAML breaks after a FortiGate firmware upgrade with Entra ID as IdP, don’t assume your configuration is lost.
    • Enable “Sign SAML response and assertion” in Microsoft Entra ID for the affected application.
    • Re-test sign-in—authentication should start working immediately.

    Reference
    Fortinet community article on post-upgrade SAML issues:
    Troubleshooting Tip – SAML Authentication fails after firmware upgrade

    Tip: If you manage multiple FortiGate clusters, note this requirement in your upgrade checklist to avoid surprise outages.

    Problems in connection to a Webservice from Windows Server 2016 / 2019

    Today, I have this issue, that i could not connect to a webservices, that are hosted by the Danish Tax Service, the URL where: https://emcstest.skat.dk
    I got this warning:

    Invoke-WebRequest : The request was aborted: Could not create SSL/TLS secure channel.

    When running these commands

    [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
    $WebResponse = Invoke-WebRequest "https://emcstest.skat.dk"

    No matter what I did. But final I tested the webpage against SSLLabs
    https://www.ssllabs.com/ssltest/analyze.html?d=emcstest.skat.dk
    Found these ciphers

    I then run these commands:

    Enable-TlsCipherSuite TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
    Enable-TlsCipherSuite TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
    Enable-TlsCipherSuite TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
    Enable-TlsCipherSuite TLS_AES_256_GCM_SHA384
    Enable-TlsCipherSuite TLS_AES_128_GCM_SHA256
    Enable-TlsCipherSuite TLS_CHACHA20_POLY1305_SHA256
    Enable-TlsCipherSuite TLS_AES_256_GCM_SHA384

    And finally I where able to access the webpage though powershell.

    Connect to 365 Exchange mailbox with IMAP and OAuth

    Source: https://stackoverflow.com/questions/73370661/php-connect-mailbox-office-365-with-oauth

    1 – Configure your mail box in Azure

    (I didn’t do this part so i can’t help you more than that ! )

    Edit : Thanks to parampal-poonithis link explains how to configurate in azure.

    You will need :

    • The client Id
    • The tenant Id
    • The secret client
    • The redirect Uri (Set it to http://localhost/test_imap)

    2 – Grab a code to get a token

    Construct this url :

    $TENANT="5-48...";
    $CLIENT_ID="c-9c-....";
    $SCOPE="https://outlook.office365.com/IMAP.AccessAsUser.All";
    $REDIRECT_URI="http://localhost/test_imap";
    
    $authUri = 'https://login.microsoftonline.com/' . $TENANT
               . '/oauth2/v2.0/authorize?client_id=' . $CLIENT_ID
               . '&scope=' . $SCOPE
               . '&redirect_uri=' . urlencode($REDIRECT_URI)
               . '&response_type=code'
               . '&approval_prompt=auto';
    
    echo($authUri);

    Go to the link, connect to the mail box with the passeword. Once it done, you will be redirect to : http://localhost/test_imap?code=LmpxSnTw…&session_state=b5d713….

    Save the code (remove the ‘&’ at the end !) and the session state inside the url. These codes expired after a few hours !

    When you are on this new page look inside the url, you should have htp:/localhost/test_imap?code=MyCodeIShouldSave&session_state=MySessionIShouldSave This is the $CODE and the $SESSION you are looking for for the step 3

    3 – Get an access token

    $CLIENT_ID="c-9c-....";
    $CLIENT_SECRET="Y~tN...";
    $TENANT="5-48...";
    $SCOPE="https://outlook.office365.com/IMAP.AccessAsUser.All offline_access";
    $CODE="LmpxSnTw...";
    $SESSION="b5d713...";
    $REDIRECT_URI="http://localhost/test_imap";
    
    echo "Trying to authenticate the session..";
    
    $url= "https://login.microsoftonline.com/$TENANT/oauth2/v2.0/token";
    
    $param_post_curl = [ 
     'client_id'=>$CLIENT_ID,
     'scope'=>$SCOPE,
     'code'=>$CODE,
     'session_state'=>$SESSION,
     'client_secret'=>$CLIENT_SECRET,
     'redirect_uri'=>$REDIRECT_URI,
     'grant_type'=>'authorization_code' ];
    
    $ch=curl_init();
    curl_setopt($ch,CURLOPT_URL,$url);
    curl_setopt($ch,CURLOPT_POSTFIELDS, http_build_query($param_post_curl));
    curl_setopt($ch,CURLOPT_POST, 1);
    curl_setopt($ch,CURLOPT_RETURNTRANSFER, true);
    
    $oResult=curl_exec($ch);
    
    echo "result : \n";
    
    var_dump($oResult);

    The access_token given in response is going to work only for a few hours. ( If your script is going to be launch on a daily basic you need to recreate a token. I’m going to show you how in the part 5 ! Save the refresh_token inside $oResult. (It are in the middle of the output).
    If you don’t have the “refresh_token” you have forgot to put “offline_access” in the scope)

    4 – Connect to the mail box

    Now choose your favorite library 😉 ! We will use webklex/php-imap for this example (https://github.com/Webklex/php-imap)

    include __DIR__.'/vendor/autoload.php'; 
        
    use Webklex\PHPIMAP\ClientManager;
    
    $access_token="EH.j8s5z8...";
        
    //$cm = new ClientManager($options = ["options" => ["debug" => true]]);                     
    $cm = new ClientManager();                      
    $client = $cm->make([
        'host'          => 'outlook.office365.com',                
        'port'          => 993,
        'encryption'    => 'ssl',
        'validate_cert' => false,
        'username'      => '[email protected]',
        'password'      => $access_token,
        'protocol'      => 'imap',
        'authentication' => "oauth"
    ]);
    
    try {
        //Connect to the IMAP Server
        $client->connect();
        $folder = $client->getFolder('INBOX');
        $all_messages = $folder->query()->all()->get();
        //DONE ! :D     
    } catch (Exception $e) {
        echo 'Exception : ',  $e->getMessage(), "\n";

    5 – Connecting to the mail box everyday

    include __DIR__.'/vendor/autoload.php'; 
        
    use Webklex\PHPIMAP\ClientManager;
    
    $CLIENT_ID="c-9c-....";
    $CLIENT_SECRET="Y~tN...";
    $TENANT="5-48...";
    $REFRESH_TOKEN="EebH9H8S7...";
    
    $url= "https://login.microsoftonline.com/$TENANT/oauth2/v2.0/token";
    
    $param_post_curl = [ 
     'client_id'=>$CLIENT_ID,
     'client_secret'=>$CLIENT_SECRET,
     'refresh_token'=>$REFRESH_TOKEN,
     'grant_type'=>'refresh_token' ];
    
    $ch=curl_init();
    
    curl_setopt($ch,CURLOPT_URL,$url);
    curl_setopt($ch,CURLOPT_POSTFIELDS, http_build_query($param_post_curl));
    curl_setopt($ch,CURLOPT_POST, 1);
    curl_setopt($ch,CURLOPT_RETURNTRANSFER, true);
    //ONLY USE CURLOPT_SSL_VERIFYPEER AT FALSE IF YOU ARE IN LOCALHOST !!!
    curl_setopt($ch,CURLOPT_SSL_VERIFYPEER, false);// NOT IN LOCALHOST ? ERASE IT !
    
    $oResult=curl_exec($ch);
    
    echo("Trying to get the token.... \n");
    
    if(!empty($oResult)){
        
        echo("Connecting to the mail box... \n");
        
        //The token is a JSON object
        $array_php_resul = json_decode($oResult,true);
        
        if( isset($array_php_resul["access_token"]) ){
    
            $access_token = $array_php_resul["access_token"];
    
            //$cm = new ClientManager($options = ["options" => ["debug" => true]]);                     
            $cm = new ClientManager();                      
            $client = $cm->make([
                'host'          => 'outlook.office365.com',                
                'port'          => 993,
                'encryption'    => 'ssl',
                'validate_cert' => false,
                'username'      => '[email protected]',
                'password'      => $access_token,
                'protocol'      => 'imap',
                'authentication' => "oauth"
            ]);
            
            try {
                //Connect to the IMAP Server
                $client->connect();
            }catch (Exception $e) {
                echo 'Exception : ',  $e->getMessage(), "\n";
            }
    
        }else{
            echo('Error : '.$array_php_resul["error_description"]); 
        }
    }

    It will only connect to the mailbox, you then need to write some more code to get access to the mail. Look at https://github.com/Webklex/php-imap

    Computer won’t join Azure AD

    When going to Settings -> Accounts -> Access work or school, og push the “connect” buttom. I could just see that the popup, asking for my mail address, just popup, but then disapear again very quick.

    Starting a powershell with administrative rights, and type in the command

    Get-AppXPackage | foreach {Add-AppxPackage -DisableDevelopmentMode -Register "$($_.InstallLocation)\AppXManifest.xml"}

    And let it run, it toke 1-3 minutes to complete, but when it completed i could push the buttom, and the popup show just fine.

    Again this is a danish screenshot.


    Enterprise Root CA can’t issue more than 2-year certificate

    If you want to issue a certificate with 20 years expiration, run this commands:

    certutil -setreg ca\ValidityPeriodUnits 20
    
    certutil -setreg ca\ValidityPeriod "Years"
    
    net stop certsvc
    
    net start certsvc

     

    To issues a certificate with a template, run this command

    certreq -submit -attrib "CertificateTemplate:CertificateTemplateName" CSRfile.csr

     

     

    Deny Dropbox from running with GPO

    Start Group Policy Management Editor
    Go to:
    Computer Configuration\Policies\Windows Settings\Security Settings\Software Restriction Policies

    If you see:

    Dropbox1

    On the right screen, then you need to right click on Software Restriction Policies, and choice “New Software Restricition Policies” first.

    Right click on
    Additional Rules, and choice “New Path Rule…”

    Path should be:
    %AppData%\Dropbox\bin\*.exe
    Set security level to Disallowed
    Dropbox2

    Make a another new Path rule, and set path to:
    %AppData%\Roaming\Dropbox\bin\*.exe

    Set security level to Disallowed

    To update GPO right away:
    Run CMD as Administrator, and type: gpupdate /force
    Dropbox3

    This will update the group policy on the machine this command is run at.

    Get a list of all VM in a cluster, that dosen’t hve Limit CPU For migration set to true

    Get a list of all VM in a cluster, that dosen’t hve Limit CPU For migration set to true:

    Import-Module -Name "virtualmachinemanager"
    Get-Vmmserver localhost
    $hc = Get-VMHostCluster -Name CLUSTERNMAE
    $hosts =get-vmhost -VMHostCluster $hc
    foreach($h in $hosts) {
    	get-vm -vmhost $h |Where { $_.LimitCPUForMigration –eq $FALSE } | select Name
    }
    

     

    Windows 8 and Microsoft VPN problems

    Today i have the problem where a Windows 8 machine, won’t connect to Microsoft VPN server.

    The problems was that MSChapV2 was disabled on the client.
    Please find this under Security and Allowed these protocols.

    The error message I got from both the VPN servers and the client was:

    Server:
    The following error occurred in the Point to Point Protocol module on port: VPN2-9, UserName: XXXXX\XX. The connection was prevented because of a policy configured on your RAS/VPN server. Specifically, the authentication method used by the server to verify your username and password may not match the authentication method configured in your connection profile. Please contact the Administrator of the RAS server and notify them of this error.

    Client:
    Error 815: The connection was prevented because of a policy configured on your RAS/VPN server. Specifically, the authentication method used by the server to verify your username and password may not match the authentication method configured in your connection profile. Please contact the Administrator of the RAS server and notify them of this error.

    Please see more here: http://jermsmit.com/windows-8-vpn-error-812/

    Microsoft CRM failed to install

    Microsoft CRM Outlook Client Connector has the Visual C++ 2010 x86 Redistributable as a dependancy.

    It will automaticaly install the Visual C++ 2010 x86 Redistributable when you install Microsoft CRM outlook Client connector, but it may failed with:
    Installation of Microsoft Visual C++ Runtime failed. Exit code: 5100. Result: Asia.

    in Danish:

    Installationen af Microsoft Visual C++ Runtime mislykkedes. Afslutningskode: 5100. Resultat: Asien

     

    If you try to download and install Microsoft Visual C++ Runtime 2010 manual, you get a better error messages:
    A newer version of Microsoft Visual C++ 2010 Redistributable has been detected on the machine.

    Just remove  Microsoft Visual C++ Runtime 2010 from Programs in Control Panel and try to install it again