IdP-Initiated Login from Okta to Fortinet Fails with "Bad request error"
Last Updated:
Overview
When integrating Fortinet with Okta using Security Assertion Markup Language (SAML), administrators may find that although they are able to authenticate into Fortinet with Okta credentials when signing in directly to Fortinet (when doing a Service Provider (SP)-initiated login), they are not able to authenticate into the application when they attempt to launch Fortinet from the Okta dashboard tile or by using the app embed link (when doing an Identity Provider (IdP)-initiated login).
The message received when attempting to do an IdP-initiated login is:
Bad request error.
Applies To
- Fortinet SAML integration
- Identity Provider (IdP)-initiated login not working
Cause
Fortinet only supports SP-initiated login (login attempts originating from the application). Any IdP-initiated login (login attempts starting on the Okta side) will fail with the error message: Bad request error.
FortiGate appliances are designed to reject these unsolicited login attempts as a security measure to prevent risks like session fixation and phishing, as explained in Technical Tip: IdP/Proxy Initiated SAML SSO Login is Not Supported for FortiGate Login.
Solution
The first possible solution is to advise users to launch Fortinet only from the Fortinet application.
Another alternative is to create a Bookmark application in Okta, which redirects to Fortinet's application so users can start the authentication process on the SP's side, mimicking IdP-initiated login.
