Hello,
Fortiweb offers the option to change password before logging in. If this option is used and the password change fails, where do I see the details?
The login and therefore also a possible password change is done against a MS-AD.
The user gets as error message "Failed to change password", but in the logs no reason can be seen.
Unfortunately, the details under Log&Report / Traffic do not provide any clues for error analysis.
Many thanks
TBC
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
@TBC By design, HTTP request (URL - /site_publishing_helper/cpw_check/0) carrying the updated new password payload is recorded in the traffic log, but it doesn't record why the password update change failed (it is not the purpose of the traffic log). You could run capture for LDAP packets (you need to turn off SSL communication and use plaintext) and see at what stage the LDAP communication fails. If you see it fails during Bind Request (carrying the updated password), then probably you need to check on the MS AD to figure out why it doesn't accept the password update.
You could also run the following debug commands, but the debug log is not that descriptive.
diag deb reset
diag deb timestamp enable
diag deb application site-publish 7
diag deb flow filter client-ip <client IP>
diag deb flow filter server-ip <VIP>
diag deb flow trace start
diag deb info
diag deb enable
@TBC By design, HTTP request (URL - /site_publishing_helper/cpw_check/0) carrying the updated new password payload is recorded in the traffic log, but it doesn't record why the password update change failed (it is not the purpose of the traffic log). You could run capture for LDAP packets (you need to turn off SSL communication and use plaintext) and see at what stage the LDAP communication fails. If you see it fails during Bind Request (carrying the updated password), then probably you need to check on the MS AD to figure out why it doesn't accept the password update.
You could also run the following debug commands, but the debug log is not that descriptive.
diag deb reset
diag deb timestamp enable
diag deb application site-publish 7
diag deb flow filter client-ip <client IP>
diag deb flow filter server-ip <VIP>
diag deb flow trace start
diag deb info
diag deb enable
Many thanks Denzil,
It looks like the problem is limited to certain passwords. However, I have not yet been able to find out why this is the case, especially since the password does not contain any special characters, but only a _ and a !
I'll see if I can narrow it down.
Thanks for the support
TBC
@TBC No problem. If you have any further queries w.r.t site publish authentication, please feel free to post here.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1641 | |
1069 | |
751 | |
443 | |
210 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.