Fortiweb - Logdetails for Password change

Forum|Forum|4 years ago
June 28, 2022
3 replies
3805 views

Hello,

Fortiweb offers the option to change password before logging in. If this option is used and the password change fails, where do I see the details?
The login and therefore also a possible password change is done against a MS-AD.
The user gets as error message "Failed to change password", but in the logs no reason can be seen.

Unfortunately, the details under Log&Report / Traffic do not provide any clues for error analysis.

Many thanks

TBC

FortiWEB

Best answer by ddsouza_FTNT

@TBC By design, HTTP request (URL - /site_publishing_helper/cpw_check/0) carrying the updated new password payload is recorded in the traffic log, but it doesn't record why the password update change failed (it is not the purpose of the traffic log). You could run capture for LDAP packets (you need to turn off SSL communication and use plaintext) and see at what stage the LDAP communication fails. If you see it fails during Bind Request (carrying the updated password), then probably you need to check on the MS AD to figure out why it doesn't accept the password update.

You could also run the following debug commands, but the debug log is not that descriptive.

diag deb reset

diag deb timestamp enable

diag deb application site-publish 7

diag deb flow filter client-ip <client IP>

diag deb flow filter server-ip <VIP>

diag deb flow trace start

diag deb info

diag deb enable

ddsouza_FTNTAnswer

Staff

@TBC By design, HTTP request (URL - /site_publishing_helper/cpw_check/0) carrying the updated new password payload is recorded in the traffic log, but it doesn't record why the password update change failed (it is not the purpose of the traffic log). You could run capture for LDAP packets (you need to turn off SSL communication and use plaintext) and see at what stage the LDAP communication fails. If you see it fails during Bind Request (carrying the updated password), then probably you need to check on the MS AD to figure out why it doesn't accept the password update.

You could also run the following debug commands, but the debug log is not that descriptive.

diag deb reset

diag deb timestamp enable

diag deb application site-publish 7

diag deb flow filter client-ip <client IP>

diag deb flow filter server-ip <VIP>

diag deb flow trace start

diag deb info

diag deb enable

TBCAuthor

Explorer

Many thanks Denzil,

It looks like the problem is limited to certain passwords. However, I have not yet been able to find out why this is the case, especially since the password does not contain any special characters, but only a _ and a !
I'll see if I can narrow it down.

Thanks for the support

TBC