FAC Windows Authentication Fails for Domain-Joined PCs Using MSCHAPv2 (Wrong username or password)

[Jalal-ali99]

Hello everyone,

I'm experiencing an issue with MSCHAPv2 authentication on FortiAuthenticator (FAC) when using Windows AD domain authentication.

My FAC is joined to Active Directory, shows as fully connected to the domain controllers, and I have a RADIUS policy configured with “Windows AD domain authentication” enabled.

Problem Description

When domain-joined Windows PCs attempt 802.1X authentication, they automatically send the logged-in user’s credentials.
However, FAC rejects these attempts with the following log message: "Windows AD user authentication from (null) (mschap) with no token failed: AD auth error: The attempted logon is invalid. This is either due to a bad username or authentication information. (0xc000006d)"

interestingly, this issue does not occur on non-domain (workgroup) PCs.
When a user manually enters the same domain username and password, authentication succeeds without any problem.

I have also tested different username formats, including: realm\username and username@realm

But the authentication still fails when the credentials are automatically supplied by domain-joined PCs.

 

Thanks in advance for any help.

[AEK]

Hi Jalal

For domain joined PC, are you entering manually the credentials or are they auto-filled?

If auto-filled then try manually and enter them in the exact way as for the non-joined PC.

[Jalal-ali99]

Hi 
on domain-joined PCs there is a group policy that forces the PCs to send credential of logged-in users to the authenticator (switch) so there is no need for the users to enter their credential every time after they login.
it's so disturbing to disable this policy for the users and its almost impossible for +300 PCs 

[AEK]

If you can't test with one user then try check in FAC logs the username sent by the client, and compare it with the same for the non-domain-joined clients. Something tells me the difference is here.

[Jalal-ali99]

I compare the username and password received by FAC 
domain-joined PCs send their username without any @domain but on workgroup PCs , users need to add @domain manually and FAC receives it with @ 

[AEK]

If this is the difference then just edit the related RADIUS policy and configure it to add "@domain" in case the username doesn't include it. It should work.

[ebilcari]

From what I have seen, the Windows supplicant should include the domain in the format domain\username. I have not seen any case where it automatically sends only the username. Check if there is any customization in the supplicant configuration.

[AEK]

Try this setting in the related RADIUS policy.