SSl-VPN - Change pwd for AD User getting "Policy ID Implicit Deny"

[TBC]

Hello @All,

we're using ssl-vpn with portal, an Active Directory login.

Login woks fine!

If a password is expired for a ssl-vpn AD-User, he gets on portal the message that one is expired, so pls. Change it. If the user try to change that on, he gets after that Error: Permission denied.

On Log, I see "Policy ID Implicit Deny"

How can I fix that?

Many thanks

TheBob

[Markus_M]

Hi TBC,

try the domain admin - only for test. If that fixes the problem you know for sure it is a privilege issue and not a strange message you would not be able to fix with the privileges. Verification is better than assumption. Another way of trust is good, control is better ;)

Least privileges are otherwise like:

https://docs.fortinet.com/document/fortigate/6.4.0/administration-guide/140978/configuring-least-pri...

Best regards,

Markus

[TBC]

Hello Markus,

I did that already, pls See my last post from 09-22-2022 12:16 AM:

Dom-Admin is working, the least privileges are not.

Many thanks

TBC

[ck8882]

I do have same concern query for it. Anyone have the idea and know the reason why need use "write" permission?