FortiClient EMS Domain/LDAP Authentication Hangs Indefinitely - Resolved

Symptoms

We were configuring FortiClient EMS invitations using Domain/LDAP authentication.

The environment appeared to be correctly configured:

• The Active Directory domain was successfully imported into EMS.
• Users were visible in EMS and could be selected when creating an individual invitation.
• No errors were reported in the AD Connector logs.
• EMS synchronization with AD appeared healthy.

However, when users attempted to authenticate through the Domain/LDAP invitation workflow, they entered their AD credentials and the authentication window would remain in a continuous loading state indefinitely, without returning any error message.

Troubleshooting

Initially, no obvious issues were visible in the EMS GUI or AD Connector logs.

To investigate further, we enabled Debug Log Mode on EMS and reproduced the issue.

The debug logs revealed the following message:

Authentication error: User not found in DB

This was unexpected because:

• The user existed in Active Directory.
• The user had already been imported into EMS.
• AD synchronization was working.

Root Cause

The issue appeared to be related to a corruption or inconsistency within the EMS database records associated with the managed domain and imported users.

Although the users were visible in the EMS interface, the authentication process was unable to properly locate the user record in the EMS database.

Solution

We removed the Managed Domain from EMS and then added it again, allowing EMS to perform a fresh synchronization with Active Directory.

After the domain was re-added:

• Users were imported again.
• Domain/LDAP authentication started working normally.
• Invitations authenticated successfully.
• The indefinite loading behavior disappeared.