Skip to main content
AEK
SuperUser
AEK
SuperUser
July 10, 2024
Question

FortiAuthenticator offline authentication token issue

  • July 10, 2024
  • 2 replies
  • 4031 views

Hello
We have FAC version 6.4.9, with Windows agent version 4.3, 2FA with FortiToken mobile.

While online authentication works just fine, sometimes some users fail to login when they open a Windows session in offline mode (disconnected from the Corp network). The error shown on Windows login screen is user and password incorrect with "Offline Tokens: None Available".

As this behavior appears from time to time it becomes a real issue, especially when the user is offsite as we can't assist him.

Any hint to fix or troubleshoot the issue would be appreciated.

2 replies

rbraha
Staff
rbraha
Staff
July 11, 2024

Hi @AEK 

In case of this user using offline token , l would suggest to delete offline token for this user from FAC  Agent- Simulation Tab there is an option to delete these file of offline token downloaded on this PC.

Then the user need to login on local network first ,an new list of offline token will be downloaded automatically from FAC to end user PC and then you can test it again to login using offline token.

    AEK
    SuperUser
    AEKAuthor
    SuperUser
    July 11, 2024

    Hello Braha, and thanks for your feedback.

     

    Actually we could fix the issue in a simple way just by disabling the offline authentication on the Windows agent, then enabling it again.

    Actually this is a workaround and it works, however the problem is that when user is offsite and can't connect due to this issue then it is difficult to assist him and sometimes not even possible, so we are trying to find a good solution that will prevent such behavior to happen once for all.

     

    Meanwhile and besides, any quick & secure workaround is welcome. I'm think about enabling emergency code (or other good temporary solution), however I'm wondering how secure is this solution comparing with TOTP token and what is the best practice for it.

     

    Any further advice would be appreciated.

    AEK
      rbraha
      Staff
      rbraha
      Staff
      July 11, 2024

      Hi,

      By default this file is save in the following path: C:\Program Files\Fortinet\FortiAuthenticator Agent\Offline\  and its valid for 7 days but can be increased on FAC side but for some reason when user authenticate using one  token and which is compared with this list it may fail, so this token code it may be not in this list.

      That's why l asked to delete this file and logout/login from PC in a local network will download automatically another list from FAC.

       

      Regarding Emergency token it is secure but it can only used on cases when user does not have access to his phone but l think cannot be used every day.

        AEK
        SuperUser
        AEKAuthor
        SuperUser
        August 2, 2024

        We finally found that the issue was caused by a couple of misconfigurations:

        • Upgraded the Windows agent from 4.3 to 5.3
        • Some users had their mobile phone not synchronized with NTP server -> This one has been fixed just by enabling auto date/time on the phone
        • One user had the character "ç" in his username. TAC support said it not supported for offline token -> We had to migrate his domain account to a new one without "ç" character
        AEK
          Terms & ConditionsAccessibility statement