HTTP 400 Bad Request error

Description

Users encounter an HTTP 400 Bad Request error when launching secrets in FortiPAM version 7.0.0 after a passkey is registered and an Active Directory password change occurs.

Scope

FortiPAM version 7.0.00.

Solution

After upgrading FortiPAM to firmware version 7.0.0, users cannot launch secrets. The browser returns an HTTP 400 Bad Request error.

This issue occurs even for users who do not have a registered passkey and authenticate with a standard username and password. Both native Remote Desktop and Web RDP launches are affected.

Trigger condition:

The issue is triggered when at least one user has a FIDO2 passkey registered in FortiPAM and a password change occurs for an Active Directory user. This combination causes the FortiPAM internal WAD process to reject launching requests by incorrectly identifying them as SSO launching requests that fail validation.

WAD debug logs show the following error sequence:

wad_pam_parse_parameters: Target only SSO launching username=xxx, 115:0 wad_pam_parse_parameters: Unexpected PAM launching request ..., err_code=5
wad_pam_token_alloc: fail to get security launcher!__wad_http_build_replmsg_resp: Generating replacement message. http request parse fail repmsg_id 0

Forward response from Internal: HTTP/1.1 400 Bad Request

This is a known issue and currently under investigation.

Workaround:

To restore secret launching functionality:

• Remove all registered passkeys from all FortiPAM users.

• Instruct all users to log out of FortiPAM.

• Instruct all users to log back in to FortiPAM.

After completing these steps, normal secret launching through the GUI is restored.