Technical Tip: Local user authentication from x.x.x.x (MS-CHAP) with cloud token failed: invalid user parameter

In FortiAuthenticator raw logs, the 1st attempt happens with MS-CHAP, 2nd attempt happens with CHAP, and 3rd attempt happens with PAP. In this use case, the authentication is successful with PAP.

date=2025-11-26 time=10:50:22+0000 oid=3060 logid=20002 cat="Event" subcat="Authentication" level="information" nas="10.10.19.17" action="Authentication" status="Success" msg="Local user authentication from x.x.x.x with cloud token successful" user="joe" 

date=2025-11-26 time=10:50:18+0000 oid=3059 logid=20300 cat="Event" subcat="Authentication" level="information" nas="10.10.19.17" action="Authentication" status="Pending" msg="Local user authentication partially done, expecting cloud token" user="joe" -----------> (3).

date=2025-11-26 time=10:50:16+0000 oid=3058 logid=20105 cat="Event" subcat="Authentication" level="information" nas="10.10.19.17" action="Authentication" status="Failed" msg="Local user authentication from x.x.x.x (chap) with cloud token failed: invalid user parameter" user="joe"

date=2025-11-26 time=10:50:10+0000 oid=3057 logid=20300 cat="Event" subcat="Authentication" level="information" nas="10.10.19.17" action="Authentication" status="Pending" msg="Local user authentication(chap) partially done, expecting cloud token" user="joe" ----------> (2).

date=2025-11-26 time=10:50:08+0000 oid=3056 logid=20105 cat="Event" subcat="Authentication" level="information" nas="10.10.19.17" action="Authentication" status="Failed" msg="Local user authentication from x.x.x.x (mschap) with cloud token failed: invalid user parameter" user="joe"

date=2025-11-26 time=10:50:01+0000 oid=3055 logid=20300 cat="Event" subcat="Authentication" level="information" nas="10.10.19.17" action="Authentication" status="Pending" msg="Local user authentication(mschap) partially done, expecting cloud token" user="joe" -----------> (1).

In FortiGate under an IPsec tunnel, the default 'auto server' setting is used. When Windows-AD authentication is enabled, the connection between FortiAuthenticator and FortiGate uses MS-CHAP. In the case of FortiToken Cloud, FortiGate does not send a cleartext token code for the non-PAP case.

Solution:

Modify to PAP server under XAUTH settings in the IPsec tunnel through RADsec.