Two-Factor auth issue

[Chris2485]

Hi, We recently upgraded to 4.3.5 from 4.2.8 as we wanted to take advantage of two factor authentication that was available in MR3. I have users configured in the User section with the option to match user on radius server for authentication against AD (This is not new config is working fine) Now that we have the latest firmware and some Fortitokens, I enabled two factor authentication and assigned a fortitoken to a user. I attempted to login to SSL VPN and everything worked. ie it prompted for the token number and accepted it. However, I' ve either configured something wrong or have found a Major bug. If the users username is configured on the FG as " firstname.lastname" (all lower case) and the user logs in with usename in exact format everything works. If the user doesn' t match the case ie " Firstname.Lastname" the fortigate doesn' t prompt for the fortitoken code and authenticates the user anyway. Hence making the fortitoken pointless. Has anyone come across this before or think i may have done something wrong? Ive created a ticket but have had no response so far. Many Thanks Chris

[nothingel]

I can confirm your findings. In my case, I' m using LDAP instead of RADIUS. What' s happening in my case is that if a match isn' t made against a case-sensitive user list on the Fortigate, it " falls through" to the remote servers. This is a nice feature where you can selectively require FortiTokens for some users. However, as you' ve noted, the case-sensitive nature makes for some unexpected results. So, it' s either a bug or a feature, depending upon your perspective. My vote is for case-insensitivity.

[Chris2485]

I cant imagine it being a feature as it is a bit of a security risk allowing a user to (Either intentionally or Accidentally) bypass the need for their Fortitoken code. The only way I have been able to get around it is by creating local accounts for the users which I don' t really want to do. Still waiting on a response from Fortinet.