SAML 2.0 Azure AD / Entra ID Assertion Drift Triggering Infinite Login Loop
Clock skew exceeding 120 seconds between Microsoft Entra ID (Azure AD) and the FortiOS SAML Service Provider daemon (samld) invalidates assertion timestamp conditions, triggering continuous HTTP 302 redirects and trapping remote workers in recursive login loops.
Technical Root Cause Analysis
During SAML 2.0 single sign-on flows, Microsoft Entra ID signs an XML assertion containing strict cryptographic time boundaries: <saml:Conditions NotBefore="2026-09-11T01:10:00Z" NotOnOrAfter="2026-09-11T01:15:00Z">. The FortiOS SAML daemon (samld) parses these attributes using its local system clock.
When network NTP synchronization is interrupted (e.g. firewall egress blocking UDP port 123, hypervisor host clock skew on FortiGate-VM, or hardware RTC drift), the FortiGate clock drifts relative to Microsoft UTC time. If this skew exceeds 120 seconds, the sp_validator module rejects the assertion as either "Not yet valid" (FortiGate clock is behind) or "Assertion has expired" (FortiGate clock is ahead).
Because the user's browser maintains an active session cookie with Entra ID, the FortiGate issues an HTTP 302 redirect back to the IdP authorization endpoint. Entra ID sees an authenticated session and immediately issues a fresh SAML response back to the FortiGate Assertion Consumer Service (ACS) URL. The FortiGate rejects it again, generating an infinite HTTP 302 redirection storm that spikes samld CPU and locks out all enterprise SSL-VPN and ZTNA users.
Affected Firmware & Blast Radius Matrix
| FortiOS Branch | Vulnerable Builds | Confirmed Clean Build | Status & Workaround |
|---|---|---|---|
| FortiOS 7.2 | 7.2.2 – 7.2.6 | 7.2.7+ | Configure set clock-tolerance 300 in user saml |
| FortiOS 7.4 | 7.4.0 – 7.4.1 | 7.4.2+ | Native clock tolerance + NTP sync repair |
| FortiOS 7.0 | 7.0.8 – 7.0.12 | 7.0.13+ | Manual NTP sync + internal stratum 1 NTP server |
Platform Impact: All FortiGate hardware and VM firewalls using SAML 2.0 authentication for SSL-VPN remote access, ZTNA application gateways, or Web GUI administrative single sign-on.
Step 01: Free Verification CLI (Safe Read-Only)
Execute these diagnostic commands to inspect SAML daemon validation failures and compare FortiGate system time against active NTP peers:
Diagnostic Commands
# 1. Enable live SAML service provider debugging
diagnose debug reset
diagnose debug application samld -1
diagnose debug enable
# 2. Verify current system date and NTP synchronization status
get system status | grep -E "Date|System time"
diagnose sys ntp status
# 3. Check active SSL-VPN tunnels to confirm session dropouts
diagnose vpn ssl list
# 4. Turn off debugging once redirection traces are recorded
diagnose debug disableRemediation & Workaround Steps (Teaser Preview)
Step-by-step remediation procedures available in the interactive Ferrite platform:
Frequently Asked Questions
Microsoft Entra ID assertions are valid for only 5 minutes. If the firewall clock is skewed by >120 seconds, the assertion is rejected. Because the browser retains an active IdP session, the IdP keeps redirecting the client back with new assertions, triggering a loop.
Increase the allowable clock skew window by configuring set clock-tolerance 300 in the SAML user profile, followed by resynchronizing NTP.
Yes. When timestamps are outside acceptable thresholds, conditional access token lifetime evaluation fails, generating sign-in failure audit logs in Microsoft Entra admin center.