Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
TBC
Contributor

Fortiweb - Logdetails for Password change

Hello,

Fortiweb offers the option to change password before logging in. If this option is used and the password change fails, where do I see the details?
The login and therefore also a possible password change is done against a MS-AD.
The user gets as error message "Failed to change password", but in the logs no reason can be seen.

Unfortunately, the details under Log&Report / Traffic do not provide any clues for error analysis.

 

Many thanks

TBC

1 Solution
ddsouza_FTNT
Staff
Staff

@TBC By design, HTTP request (URL - /site_publishing_helper/cpw_check/0) carrying the updated new password payload is recorded in the traffic log, but it doesn't record why the password update change failed (it is not the purpose of the traffic log). You could run capture for LDAP packets (you need to turn off SSL communication and use plaintext) and see at what stage the LDAP communication fails. If you see it fails during Bind Request (carrying the updated password), then probably you need to check on the MS AD to figure out why it doesn't accept the password update. 

 

You could also run the following debug commands, but the debug log is not that descriptive.

diag deb reset

diag deb timestamp enable

diag deb application site-publish 7

diag deb flow filter client-ip <client IP>

diag deb flow filter server-ip <VIP>

diag deb flow trace start

diag deb info

diag deb enable

View solution in original post

3 REPLIES 3
ddsouza_FTNT
Staff
Staff

@TBC By design, HTTP request (URL - /site_publishing_helper/cpw_check/0) carrying the updated new password payload is recorded in the traffic log, but it doesn't record why the password update change failed (it is not the purpose of the traffic log). You could run capture for LDAP packets (you need to turn off SSL communication and use plaintext) and see at what stage the LDAP communication fails. If you see it fails during Bind Request (carrying the updated password), then probably you need to check on the MS AD to figure out why it doesn't accept the password update. 

 

You could also run the following debug commands, but the debug log is not that descriptive.

diag deb reset

diag deb timestamp enable

diag deb application site-publish 7

diag deb flow filter client-ip <client IP>

diag deb flow filter server-ip <VIP>

diag deb flow trace start

diag deb info

diag deb enable

TBC

Many thanks Denzil,

It looks like the problem is limited to certain passwords. However, I have not yet been able to find out why this is the case, especially since the password does not contain any special characters, but only a _ and a !
I'll see if I can narrow it down.

Thanks for the support

 

TBC

ddsouza_FTNT

@TBC No problem. If you have any further queries w.r.t site publish authentication, please feel free to post here.

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors