Token field does not displays from the forticlient VPN

[HMJRDITTEAM]

In my understanding and the most of cases,

when logging in with Forticlent VPN(to connect to the in-house server), should enter username and password. then Token field has to be displays, user has to type in the Token in displayed token field.

However, some of our members possible to connect to the in-house server without type in to token field. (Token Field does not even displays).
*Token is already given to the member in Fortigate

How can I make client to displays the Token Field?

-FortiClient VPN 7.0.9.0493

[Debbie_FTNT]

Hey!

This is only a guess, but a common case for two-factor authentication not triggering is case-sensitivity.

As an example:

- you have an LDAP server (ldap1)

- you have a user on FortiGate (user1) with a token

-> the user1 is of type ldap:
config user local
edit user1

set type ldap

set ldap-server ldap1

set token FTKxxxxxxxxxxxxxx

[...]

The FortiGate is case sensitive by default.

This means:

- if the user logs in with 'user1', this matches the local user entry, and token will be required

- if the user logs in with 'User1' or 'uSer1' or similar, then this will NOT match the local entry, and (depending on SSLVPN, group and policy configuration) go straight to LDAP instead

-> as LDAP is NOT case-sensitive, the user will be authenticated (without the token prompt)

Essentially: If the user does not match the local entry on FortiGate, two-factor authentication will not be triggered, so no token field appears.

You can refer to these KBs for a more detailed dive into the mechanism:
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Description-of-CVE-2020-12812-bypassing-tw...
https://community.fortinet.com/t5/FortiGate/Technical-Tip-A-quick-guide-to-FortiGate-SSL-VPN-authent...