SAML IdP FortiGate: Troubleshooting Frequent Re-authentication Prompts
A FortiGate is configured as a SAML IdP for a partner's cloud application. After configuring the application as a service provider, users report that they are prompted for credentials every time they access the application, even though they already authenticated to FortiGate. What is the MOST likely cause?
Quick Answer
The answer is a mismatch where the IdP session timeout is set to a lower value than the SP session timeout. This is the most likely cause of frequent re-authentication prompts because SAML SSO relies on synchronized session lifetimes between the identity provider and the service provider. When a FortiGate acts as a SAML IdP, it issues a session token that the cloud application (SP) trusts; if the IdP session expires before the SP session does, the SP will reject the cached assertion and force the user to re-authenticate at the FortiGate. On the Fortinet NSE 7 Advanced Security NSE7 exam, this concept tests your understanding of SAML session management and the critical need for consistent timeout configuration across both sides of the trust relationship. A common trap is assuming the SP controls all re-authentication behavior, but the IdP’s shorter timeout overrides the SP’s longer session. Remember the memory tip: “IdP first to expire, SP will require fire.”
⚠ Common exam trap
Many exam-takers confuse session timeout mismatch with logout URL misconfiguration, assuming that a misconfigured SLO URL causes re-authentication, when in fact SLO only handles logout, not session persistence.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The IdP session timeout is set to a lower value than the SP session timeout
When the IdP session timeout is shorter than the SP session timeout, the SP will consider the user's session expired and force re-authentication even though the FortiGate still has a valid local session. This mismatch causes the SP to initiate a new SAML authentication flow, prompting the user for credentials again. The SAML single logout URL (A) affects logout behavior, not re-authentication triggers, and an unsigned assertion (B) would cause a different error, not repeated credential prompts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The SAML single logout URL is misconfigured
Why it's wrong here
Misconfigured SLO would affect logout, not login.
- ✗
The SAML assertion is not signed
Why it's wrong here
Unsigned assertions would cause authentication failures, not repeated prompts.
- ✓
The IdP session timeout is set to a lower value than the SP session timeout
Why this is correct
If the IdP session expires, FortiGate will require re-authentication even if the SP session is still active.
- ✗
The FortiGate is not configured to generate a Name ID
Why it's wrong here
Missing Name ID would cause assertion failure, not repeated prompts.
Go deeper
Related to this question
About these practice questions
One of 940 original NSE7 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on NSE7
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A FortiGate is configured as a SAML identity provider (IdP) for a partner's SaaS application (SP). Users authenticate via FortiGate's local user database. The administrator successfully tests the SAML flow, but after some time, users are prompted to re-authenticate frequently. What is the most likely cause?
medium- A.The FortiGate's SAML service provider certificate has expired
- ✓ B.The SAML assertion lifetime is configured too short
- C.The FortiGate's clock is not synchronized with NTP
- D.The SP is using HTTP-POST binding instead of redirect
Why B: SAML assertions have a validity period. If the IdP (FortiGate) sets a short assertion lifetime or the SP's session timeout is shorter, users will be prompted to re-authenticate. The most common cause is the assertion lifetime being too short.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.