Skip to main content
inventohakk
inventohakk
New Member
June 13, 2024
Solved

Fortiauthenticatin cache problem

  • June 13, 2024
  • 4 replies
  • 3934 views

Hello,

I use fortigate and fortiauthenticator and my configurations are correct,

but some users can establish a connection after a few tries while vpn,
When I look at the fortiauthenticator logs, it says that the user was previously authorized and remains in the cache, remove it
logs as below how can I solve this problem

 

) facauth: Sending email token code (timeout 180) to firat.gazel@cnbce.com
2024-06-13T13:56:29.921757+03:00 FortiAuthenticator radiusd[24056]: (34) facauth: Updated auth log 'firat.gazel' for attempt from 10.100.100.1~176.236.73.154: Remote LDAP user authentication partially done, expecting email token
2024-06-13T13:59:18.771835+03:00 FortiAuthenticator radiusd[24056]: (35) User-Name = "firat.gazel"
2024-06-13T13:59:18.772239+03:00 FortiAuthenticator radiusd[24056]: User-Name = "firat.gazel"
2024-06-13T13:59:18.772331+03:00 FortiAuthenticator radiusd[24056]: (35) facauth: ===>Username:firat.gazel
2024-06-13T13:59:18.773880+03:00 FortiAuthenticator radiusd[24056]: (35) facauth: Input raw_username: firat.gazel Realm: (null) username: firat.gazel
2024-06-13T13:59:18.774762+03:00 FortiAuthenticator radiusd[24056]: (35) facauth: LDAP user found: firat.gazel
2024-06-13T13:59:18.774783+03:00 FortiAuthenticator radiusd[24056]: (35) facauth: WARNING: Warning: user 'firat.gazel' was partially authed before, remove it from old cache.
2024-06-13T13:59:18.775306+03:00 FortiAuthenticator radiusd[24056]: (35) facauth: Added Stripped-User-Name with value firat.gazel
2024-06-13T13:59:18.820684+03:00 FortiAuthenticator radiusd[24056]: (35) facauth: Try to bind with DN: CN=Firat Gazel,OU=Haber,OU=Users,OU=CNBC-E,DC=ilbaktv,DC=com,DC=tr
2024-06-13T13:59:18.822612+03:00 FortiAuthenticator radiusd[24056]: (35) facauth: Filter user CN=Firat Gazel,OU=Haber,OU=Users,OU=CNBC-E,DC=ilbaktv,DC=com,DC=tr by NAS group: VPN_Danisman: (&(objectClass=person)(|(memberOf=CN=VPN-Danisman,OU=VPN,OU=Groups,OU=CNBC-E,DC=ilbaktv,DC=com,DC=tr)))
2024-06-13T13:59:18.823049+03:00 FortiAuthenticator radiusd[24056]: (35) facauth: Filter user CN=Firat Gazel,OU=Haber,OU=Users,OU=CNBC-E,DC=ilbaktv,DC=com,DC=tr by NAS group: VPN_Holding: (&(objectClass=person)(|(memberOf=CN=VPN-Holding,OU=VPN,OU=Groups,OU=CNBC-E,DC=ilbaktv,DC=com,DC=tr)))
2024-06-13T13:59:18.823375+03:00 FortiAuthenticator radiusd[24056]: (35) facauth: Filter user CN=Firat Gazel,OU=Haber,OU=Users,OU=CNBC-E,DC=ilbaktv,DC=com,DC=tr by NAS group: VPN_Mali_Isler: (&(objectClass=person)(|(memberOf=CN=VPN-Mali-Isler,OU=VPN,OU=Groups,OU=CNBC-E,DC=ilbaktv,DC=com,DC=tr)))
2024-06-13T13:59:18.823655+03:00 FortiAuthenticator radiusd[24056]: (35) facauth: Filter user CN=Firat Gazel,OU=Haber,OU=Users,OU=CNBC-E,DC=ilbaktv,DC=com,DC=tr by NAS group: VPN_Satis: (&(objectClass=person)(|(memberOf=CN=VPN-Satis,OU=VPN,OU=Groups,OU=CNBC-E,DC=ilbaktv,DC=com,DC=tr)))
2024-06-13T13:59:18.823941+03:00 FortiAuthenticator radiusd[24056]: (35) facauth: Filter user CN=Firat Gazel,OU=Haber,OU=Users,OU=CNBC-E,DC=ilbaktv,DC=com,DC=tr by NAS group: VPN_Teknik: (&(objectClass=person)(|(memberOf=CN=VPN-Teknik,OU=VPN,OU=Groups,OU=CNBC-E,DC=ilbaktv,DC=com,DC=tr)))
2024-06-13T13:59:18.824211+03:00 FortiAuthenticator radiusd[24056]: (35) facauth: Filter user CN=Firat Gazel,OU=Haber,OU=Users,OU=CNBC-E,DC=ilbaktv,DC=com,DC=tr by NAS group: VPN_Haber: (&(objectClass=person)(|(memberOf=CN=VPN-Haber,OU=VPN,OU=Groups,OU=CNBC-E,DC=ilbaktv,DC=com,DC=tr)))
2024-06-13T13:59:18.824471+03:00 FortiAuthenticator radiusd[24056]: (35) facauth: Entry #1: CN=Firat Gazel,OU=Haber,OU=Users,OU=CNBC-E,DC=ilbaktv,DC=com,DC=tr
2024-06-13T13:59:18.824526+03:00 FortiAuthenticator radiusd[24056]: (35) facauth: Filter user CN=Firat Gazel,OU=Haber,OU=Users,OU=CNBC-E,DC=ilbaktv,DC=com,DC=tr by NAS group: VPN_Admin: (&(objectClass=person)(|(memberOf=CN=VPN-Admin,OU=VPN,OU=Groups,OU=CNBC-E,DC=ilbaktv,DC=com,DC=tr)))
2024-06-13T13:59:18.824879+03:00 FortiAuthenticator radiusd[24056]: (35) facauth: Sending email token code (timeout 180) to firat.gazel@cnbce.com
2024-06-13T13:59:18.825546+03:00 FortiAuthenticator radiusd[24056]: (35) facauth: Updated auth log 'firat.gazel' for attempt from 10.100.100.1~176.236.73.154: Remote LDAP user authentication partially done, expecting email token

 

 

Best answer by rbraha

Hi @sw2090 

Those logs " Remote LDAP user authentication partially done" it means that just credentials are been verified through LDAP but the user has token assigned and FAC send an Access-challenge to enter token which he receives token by email.

4 replies

rbraha
Staff
rbraha
Staff
June 14, 2024

Hi @inventohakk 

From the debug logs l can see that FAC is trying to bind multiple groups for this user. Is this user part of multiple groups, have filtered it this correct group on Radius policy? Make sure that Radius attribute configured for this group matches the correct one on firewall side.

    sw2090
    SuperUser
    sw2090
    SuperUser
    June 14, 2024

    the log states that the user was partially authed before - so first factor was cached but it still sent an email token code for 2FA to the user.

    rbraha
    Staff
    rbrahaAnswer
    Staff
    June 14, 2024

    Hi @sw2090 

    Those logs " Remote LDAP user authentication partially done" it means that just credentials are been verified through LDAP but the user has token assigned and FAC send an Access-challenge to enter token which he receives token by email.

      ndumaj
      Staff
      ndumaj
      Staff
      June 14, 2024

      Hi @sw2090 

      As rbraha mentioned, the Remote LDAP user is successfully authenticated, but the user has a token assigned and FAC is waiting for the Token code to complete the authentication process.

      Please find below the radius authentication flow when a token is in place:
      Client - FortiGate (acting as radius client) - FortiAuthenticator (Acting as radius Server) - LDAP (user DB)
      1- FGT Radius client sends radius access-request with user credentials
      2- FAC Radius Server validate the credentials towards LDAP DB and based on the LDAP response sends back an access-challenge to the FGT waiting for token, because the user is successfully authenticated and has a token assigned, or access-reject because LDAP couldn't validate the credentials
      3- FGT sends back access-request that is the response to access-challenge and contains the token code
      4- FAC validates the token and response with access-accept (or access-reject if the token is wrong)

      BR

      sw2090
      SuperUser
      sw2090
      SuperUser
      August 22, 2024

      yep and there might be some deadlock with FortiClient and email token when it doesn't use split tunneling. Then during auth your internet is gone and you cannot receive the email token on that same machine. Just ran into that here during testing :)

       

      Though I was not the thread starter.

      Terms & ConditionsAccessibility statement