Technical Tip: Local user authentication from x.x.x.x (MS-CHAP) with cloud token failed: invalid user parameter

[js2]

Description	This article describes a use case where users are unable to log in with an IPsec dial-up VPN with two-factor authentication using FortiToken Cloud.
Scope	FortiGate and FortiAuthenticator Cloud.
Solution	In FortiAuthenticator raw logs, the 1st attempt happens with MS-CHAP, 2nd attempt happens with CHAP, and 3rd attempt happens with PAP. In this use case, the authentication is successful with PAP. date=2025-11-26 time=10:50:22+0000 oid=3060 logid=20002 cat="Event" subcat="Authentication" level="information" nas="10.10.19.17" action="Authentication" status="Success" msg="Local user authentication from x.x.x.x with cloud token successful" user="joe"  date=2025-11-26 time=10:50:18+0000 oid=3059 logid=20300 cat="Event" subcat="Authentication" level="information" nas="10.10.19.17" action="Authentication" status="Pending" msg="Local user authentication partially done, expecting cloud token" user="joe" -----------> (3). date=2025-11-26 time=10:50:16+0000 oid=3058 logid=20105 cat="Event" subcat="Authentication" level="information" nas="10.10.19.17" action="Authentication" status="Failed" msg="Local user authentication from x.x.x.x (chap) with cloud token failed: invalid user parameter" user="joe" date=2025-11-26 time=10:50:10+0000 oid=3057 logid=20300 cat="Event" subcat="Authentication" level="information" nas="10.10.19.17" action="Authentication" status="Pending" msg="Local user authentication(chap) partially done, expecting cloud token" user="joe" ----------> (2). date=2025-11-26 time=10:50:08+0000 oid=3056 logid=20105 cat="Event" subcat="Authentication" level="information" nas="10.10.19.17" action="Authentication" status="Failed" msg="Local user authentication from x.x.x.x (mschap) with cloud token failed: invalid user parameter" user="joe" date=2025-11-26 time=10:50:01+0000 oid=3055 logid=20300 cat="Event" subcat="Authentication" level="information" nas="10.10.19.17" action="Authentication" status="Pending" msg="Local user authentication(mschap) partially done, expecting cloud token" user="joe" -----------> (1). In FortiGate under an IPsec tunnel, the default 'auto server' setting is used. When Windows-AD authentication is enabled, the connection between FortiAuthenticator and FortiGate uses MS-CHAP. In the case of FortiToken Cloud, FortiGate does not send a cleartext token code for the non-PAP case. Solution: Modify to PAP server under XAUTH settings in the IPsec tunnel through RADsec.