Troubleshooting Tip: Remote LDAP authentication failure due to DN character limits

Resolution:

1. Identify the Root Cause.

Before making configuration changes, verify the failure reason via the FortiAuthenticator GUI. Check the Events Log and look for 'Invalid Credentials' or 'User not found' errors.

RADIUS debug: FortiAuthenticator handles nearly all authentication via RADIUS debug, including validating remote LDAP user credentials. The RADIUS debug log (accessible under https://<FortiAuthenticator>/debug) can show related information and error messages, though debug mode (can be selected at the top of the debug log page) may need to be enabled first.

If the debug output shows 'Try to bind with username test1 because DN is over 256 bytes long', it is likely because the DN (Distinguished Name) exceeds 256 bytes/characters, as shown in the example below:

2026-02-25T14:40:09.213325+03:00 P-FortiAuthenticator radiusd[31536]: (4) facauth: Added Stripped-User-Name with value test1
2026-02-25T14:40:09.225331+03:00 P-FortiAuthenticator radiusd[31536]: (4) facauth: Try to bind with username test1 because DN is over 256 bytes long.
2026-02-25T14:40:09.225412+03:00 P-FortiAuthenticator radiusd[31536]: (4) facauth: authenticating without user_info_daemon.
2026-02-25T14:40:09.225849+03:00 P-FortiAuthenticator radiusd[31536]: (4) facauth: ERROR: ldap_simple_bind_s() failed, error:Invalid credentials
2026-02-25T14:40:09.225922+03:00 P-FortiAuthenticator radiusd[31536]: (4) facauth: Remote LDAP user authentication failed
2026-02-25T14:40:09.227601+03:00 P-FortiAuthenticator radiusd[31536]: (4) facauth: update_fac_authlog:165 nas_str = ~10.0.0.1.

Note: FortiAuthenticator by default tries to authenticate the user with the DN it received from the AD server, and if the DN is more than 256 characters, it tries to authenticate the user without a DN.

2. Remediation steps.

The usual solution to this issue is to shorten the user's Distinguished Name.

A user's DN is made up of their Common Name (CN), the Organizational Unit(s) that contain the user, and the base Distinguished Name of the LDAP server. 

An example Distinguished Name for the user 'JDoe', located in OU Editors, which is contained in OU Staff and in turn OU Community, might be:

DN=CN=JDoe,OU=Editors,OU=Staff,OU=Community,DC=test,DC=lab

Depending on the structure of the LDAP tree, a user's Distinguished Name can contain a large number of elements that identify the exact location of the user object on the LDAP tree, and thus easily exceed 256 characters.

To reduce the number of characters, the user should either be moved to a higher-level Organizational Unit (OU) so the distinguished name contains fewer elements, or the OU names should be shortened themselves.

Verification:

Attempt the login again and verify the authentication through the event logs and RADIUS debug logs.