FortiAuthenticator LDAP auth and password change over SSL VPN

[make]

Hello guys!

I already implemented a solution with FortiGate and LDAP (via LDAPS) in which it's possible for users to change the password with the SSL VPN Client if it is expired so I hope there is an FortiAuthenticator solution.

config user ldap
   edit <server_name>
   set password-expiry-warning {disable | enable}
   set password-renewal {disable | enable}
   ...
end

I'm searching for a solution in which the same is possible but the FortiGate isn't connected to an LDAP server but instead to an FortiAuthenticator via RADIUS (dynamic FortiToken Mobile assigning) which gets the User Information from the LDAP server (via LDAPS). I only found the Self Service Portal which provides this feature but this doesn't meet the customer expectations.

Do you have any experience with this? Thank you.

[Debbie_FTNT]

Hey ISAC, sure:

that toggle for Windows AD Authentication needs to be enabled as well for MSCHAPv2 to work :)

[ISAC_]

thank you very much. Everything is working as I want now.

[Debbie_FTNT]

Great to hear, ISAC :)

[smontys]

Hi everybody. Same setup here:

• FAC (6.1.2) connected via LDAPS to AD and domain joined

• FAC as Radius server to FGT (7.0.6) - MSCHAPv2

• set password-expiry-warning and set password-renewal enabled at FTG LDAP
• Use Windows AD domain authentication enabled at FAC Radius policy
• SSL VPN users are connecting to FGT which takes credentials from FAC radius server (and FAC takes by LDAPS from AD).

Users are not able to change their passwords. FAC prompts to password change but after entering the new (accomplishing password policies) it prompts again for password change.

If we uncheck 'user need to change password' at AD, user can login to FAC (user portal) and when trying to change password from there (My account, User, Change password) he gets and 'incorrect old password' message. Logs at FAC shows the following message (ID 868489):

Wrong Password. User name and old password cannot be successfully verified.

We have check CA AD server certs and are ok

Looking for LDAP or Radius errors at https://facIP/debug and nothing relevant. Nor at AD server event viewer.

Need help to diagnose that.

Thanks in advance.

Regards.

EDIT: I forget to mention that, when user try to login at VPN portal with password expired, it prompts for password change with no token prompt (but it is sent) and when trying to change, he gets 'permission denied' error.

EDIT 2: this setup was working fine time ago, and the only thing that was different is de FGT version, updated to v7 in April.