How to allow LDAP user to change password or renew expired password via ZTNA

Forum|Forum|8 months ago
November 25, 2025
5 replies
821 views

I would like to know if some have done something similar ?

How to enable a user to change password or renew expired password using ZTNA, i have seen some post but for ssl vpn or ipsec

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-allow-LDAP-user-to-change-password-at-first/ta-p/243530

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Enable-LDAP-user-to-renew-expired-password-via-VPN/ta-p/408679

FortiClient #ZTNA FortiGate

AEK

SuperUser

I don't see the relationship with ZTNA because FortiClient still connects to Telemetry even if your password has expired, and you can still open your ZTNA apps even if your password is expired.

So to change the password while you are off-fabric then you may just open a ZTNA app that helps you do so, like your Corp's OWA or any other method.

Unless you enabled periodic user re-authentication in EMS settings. Is this what you mean?

AEK

jr14Author

Visitor III

For example, we use ztna to access to the internal resource, all users are part of the domain, we have different services that use AD credential, but the credential expires after a time in the AD, so, users are unable to use their credential, I want to use ZTNA to allow the users update their password in the domain.

AEK

SuperUser

I understand that when password expires the user is unable to use its credentials to access the app.

But the FCT telemetry is still connected, and ZTNA access is not affected.

As per my knowledge I don't see how we can use ZTNA to change the AD password. I think the only way to do is to change the password via the traditional way, for example some app like OWA or any other app that allows you change it, or if your off-fabric clients have connection to AD via ZTNA I guess they will be automatically invited to change password on expiration.

AEK

Sign up

Login with SSO

Login to the community

Login with SSO