# FortiGate SAML sign-on failure after firmware upgrade

Review the captured FortiGate SAML sign-on failure after the listed firmware upgrades and the Entra signing-option change recorded as resolving it. Version applicability and the result need validation for the affected environment.

!!!warning Source-derived reference
These notes were recovered from OneNote. Configuration, permissions and operating results have not been freshly verified. Confirm the applicable authority and environment before acting.
!!!

After upgrading to **v7.2.12, v7.4.9, and v7.6.4**, users get "Firewall Authentication Failed" when doing an SSO auth via the captive portal.

As per Change \#1196434, the following FortiOS versions add a CLI option that allows administrators to control signature verification for SAML responses and assertions: v7.6.5, v7.4.10, v7.2.13, v7.0.18, and all later versions. The new CLI option is displayed below and allows administrators to select between requiring both the response and the assertion to be signed (enable, set by default) OR requiring that at least one of the two is signed (disable).

SOLUTION:

Microsoft Entra ID.

If Microsoft Entra ID is used as IdP, select 'Sign SAML response and Assertion' for the signing option under Single sign-on -\> SAML Certificates -\> Select Edit -\> SAML Signing Certificate, as shown in the screenshot below:

[Screenshot retained for review](../../review/Review-status.md#asset-7fdabbabf8e24990194b)

The source reports that SAML authentication resumed after the change and a short wait. This result has not been reproduced here.

The reported case required no further changes; that observation is not a guarantee for another environment.

Note that it is safe to enable this on the IdP both before and after upgrading firmware on the FortiGate, as earlier FortiOS versions (such as FortiOS v7.2.10, v7.4.8, and v7.6.3) already supported signed responses and assertions.

[SAML Authentication fails after firmware ... - Fortinet Community](https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-SAML-Authentication-fails-after-firmware/ta-p/407859)

## Related guidance

- [Topic overview](Introduction.md)
- [Source review status](../../review/Review-status.md)