Fortiauthenticatin cache problem

[inventohakkı]

Hello,

I use fortigate and fortiauthenticator and my configurations are correct,

but some users can establish a connection after a few tries while vpn,
When I look at the fortiauthenticator logs, it says that the user was previously authorized and remains in the cache, remove it
logs as below how can I solve this problem

) facauth: Sending email token code (timeout 180) to firat.gazel@cnbce.com
2024-06-13T13:56:29.921757+03:00 FortiAuthenticator radiusd[24056]: (34) facauth: Updated auth log 'firat.gazel' for attempt from 10.100.100.1~176.236.73.154: Remote LDAP user authentication partially done, expecting email token
2024-06-13T13:59:18.771835+03:00 FortiAuthenticator radiusd[24056]: (35) User-Name = "firat.gazel"
2024-06-13T13:59:18.772239+03:00 FortiAuthenticator radiusd[24056]: User-Name = "firat.gazel"
2024-06-13T13:59:18.772331+03:00 FortiAuthenticator radiusd[24056]: (35) facauth: ===>Username:firat.gazel
2024-06-13T13:59:18.773880+03:00 FortiAuthenticator radiusd[24056]: (35) facauth: Input raw_username: firat.gazel Realm: (null) username: firat.gazel
2024-06-13T13:59:18.774762+03:00 FortiAuthenticator radiusd[24056]: (35) facauth: LDAP user found: firat.gazel
2024-06-13T13:59:18.774783+03:00 FortiAuthenticator radiusd[24056]: (35) facauth: WARNING: Warning: user 'firat.gazel' was partially authed before, remove it from old cache.
2024-06-13T13:59:18.775306+03:00 FortiAuthenticator radiusd[24056]: (35) facauth: Added Stripped-User-Name with value firat.gazel
2024-06-13T13:59:18.820684+03:00 FortiAuthenticator radiusd[24056]: (35) facauth: Try to bind with DN: CN=Firat Gazel,OU=Haber,OU=Users,OU=CNBC-E,DC=ilbaktv,DC=com,DC=tr
2024-06-13T13:59:18.822612+03:00 FortiAuthenticator radiusd[24056]: (35) facauth: Filter user CN=Firat Gazel,OU=Haber,OU=Users,OU=CNBC-E,DC=ilbaktv,DC=com,DC=tr by NAS group: VPN_Danisman: (&(objectClass=person)(|(memberOf=CN=VPN-Danisman,OU=VPN,OU=Groups,OU=CNBC-E,DC=ilbaktv,DC=com,DC=tr)))
2024-06-13T13:59:18.823049+03:00 FortiAuthenticator radiusd[24056]: (35) facauth: Filter user CN=Firat Gazel,OU=Haber,OU=Users,OU=CNBC-E,DC=ilbaktv,DC=com,DC=tr by NAS group: VPN_Holding: (&(objectClass=person)(|(memberOf=CN=VPN-Holding,OU=VPN,OU=Groups,OU=CNBC-E,DC=ilbaktv,DC=com,DC=tr)))
2024-06-13T13:59:18.823375+03:00 FortiAuthenticator radiusd[24056]: (35) facauth: Filter user CN=Firat Gazel,OU=Haber,OU=Users,OU=CNBC-E,DC=ilbaktv,DC=com,DC=tr by NAS group: VPN_Mali_Isler: (&(objectClass=person)(|(memberOf=CN=VPN-Mali-Isler,OU=VPN,OU=Groups,OU=CNBC-E,DC=ilbaktv,DC=com,DC=tr)))
2024-06-13T13:59:18.823655+03:00 FortiAuthenticator radiusd[24056]: (35) facauth: Filter user CN=Firat Gazel,OU=Haber,OU=Users,OU=CNBC-E,DC=ilbaktv,DC=com,DC=tr by NAS group: VPN_Satis: (&(objectClass=person)(|(memberOf=CN=VPN-Satis,OU=VPN,OU=Groups,OU=CNBC-E,DC=ilbaktv,DC=com,DC=tr)))
2024-06-13T13:59:18.823941+03:00 FortiAuthenticator radiusd[24056]: (35) facauth: Filter user CN=Firat Gazel,OU=Haber,OU=Users,OU=CNBC-E,DC=ilbaktv,DC=com,DC=tr by NAS group: VPN_Teknik: (&(objectClass=person)(|(memberOf=CN=VPN-Teknik,OU=VPN,OU=Groups,OU=CNBC-E,DC=ilbaktv,DC=com,DC=tr)))
2024-06-13T13:59:18.824211+03:00 FortiAuthenticator radiusd[24056]: (35) facauth: Filter user CN=Firat Gazel,OU=Haber,OU=Users,OU=CNBC-E,DC=ilbaktv,DC=com,DC=tr by NAS group: VPN_Haber: (&(objectClass=person)(|(memberOf=CN=VPN-Haber,OU=VPN,OU=Groups,OU=CNBC-E,DC=ilbaktv,DC=com,DC=tr)))
2024-06-13T13:59:18.824471+03:00 FortiAuthenticator radiusd[24056]: (35) facauth: Entry #1: CN=Firat Gazel,OU=Haber,OU=Users,OU=CNBC-E,DC=ilbaktv,DC=com,DC=tr
2024-06-13T13:59:18.824526+03:00 FortiAuthenticator radiusd[24056]: (35) facauth: Filter user CN=Firat Gazel,OU=Haber,OU=Users,OU=CNBC-E,DC=ilbaktv,DC=com,DC=tr by NAS group: VPN_Admin: (&(objectClass=person)(|(memberOf=CN=VPN-Admin,OU=VPN,OU=Groups,OU=CNBC-E,DC=ilbaktv,DC=com,DC=tr)))
2024-06-13T13:59:18.824879+03:00 FortiAuthenticator radiusd[24056]: (35) facauth: Sending email token code (timeout 180) to firat.gazel@cnbce.com
2024-06-13T13:59:18.825546+03:00 FortiAuthenticator radiusd[24056]: (35) facauth: Updated auth log 'firat.gazel' for attempt from 10.100.100.1~176.236.73.154: Remote LDAP user authentication partially done, expecting email token

[rbraha]

Hi @inventohakkı 

From the debug logs l can see that FAC is trying to bind multiple groups for this user. Is this user part of multiple groups, have filtered it this correct group on Radius policy? Make sure that Radius attribute configured for this group matches the correct one on firewall side.

[sw2090]

the log states that the user was partially authed before - so first factor was cached but it still sent an email token code for 2FA to the user.

[rbraha · Accepted solution]

Hi @sw2090 

Those logs " Remote LDAP user authentication partially done" it means that just credentials are been verified through LDAP but the user has token assigned and FAC send an Access-challenge to enter token which he receives token by email.

[ndumaj]

Hi @sw2090 

As rbraha mentioned, the Remote LDAP user is successfully authenticated, but the user has a token assigned and FAC is waiting for the Token code to complete the authentication process.

Please find below the radius authentication flow when a token is in place:
Client - FortiGate (acting as radius client) - FortiAuthenticator (Acting as radius Server) - LDAP (user DB)
1- FGT Radius client sends radius access-request with user credentials
2- FAC Radius Server validate the credentials towards LDAP DB and based on the LDAP response sends back an access-challenge to the FGT waiting for token, because the user is successfully authenticated and has a token assigned, or access-reject because LDAP couldn't validate the credentials
3- FGT sends back access-request that is the response to access-challenge and contains the token code
4- FAC validates the token and response with access-accept (or access-reject if the token is wrong)

BR

[sw2090]

yep and there might be some deadlock with FortiClient and email token when it doesn't use split tunneling. Then during auth your internet is gone and you cannot receive the email token on that same machine. Just ran into that here during testing :)

Though I was not the thread starter.