Description
This article explains that FortiAuthenticator doesn’t store any passwords.
Scope
FortiAuthenticator.
Solution
Since firmware version v4.3, FortiAuthenticator offers users to change their AD passwords as required.
A few tickets have been raised about how FortiAuthenticator stores the password locally, scope of this article confirm that FortiAuthenticator is actually a proxy and doesn’t store password locally.
Example
The request for authentication goes to: FortiGate -> (RADIUS) -> FortiAuthenticator -> (Secure LDAP) -> AD Server
- Configure LDAP server in FortiAuthenticator, enable secure LDAP, and joined FortiAuthenticator to Windows AD domain.
- RADIUS client has been configured to 'Use Windows AD domain authentication'
- RADIUS authentication request uses MS-CHAPv2
- Enabled password renewal in RADIUS client on FortiGate:
config user radius
edit "AD-RAD"
set server "192.168.38.2"
set secret fortinet
set auth-type ms_chap_v2
set password-renewal enable
next
end
Possible experience behavior:
When user changes the password, for example (Password1) to a new one (Password2), right after the change, the user can still log successfully with the first password (Password1), after about a minute or so, then the user can only log in with the new password (Password2) as expected.
Explanation:
Such behavior might induct customer to think that FortiAuthenticator stores password locally and can be a cause of the delay on synchronization with new password between FortiAuthenticator and DC Server.
FortiAuthenticator does not store a copy of the password. It is just a proxy for the password validation against AD. Therefore, the explanation of such delay must be look for on the AD server side instead.
In the FortiAuthenticator firmware version of 6.6.0, FortiAuthenticator implements an authentication cache that also does not store the credentials, but rather the authentication state. This is done to improve performance for both the LDAP server and the FortiAuthenticator. See the documentation and release notes for the relevant information.
Note:
Check this article from Microsoft.
Related articles:
Technical Tip: How to allow LDAP user to change password at first logon or renew expired password vi...
Technical Tip: How to allow an LDAP user to change password at first logon or renew an expired passw...
