VPN WEB MODE LDAP PASSWORD CHANGE ISSUE

[LCDALMEC]

We are encountering an issue with users connecting to our VPN web portal via Fortinet using their Active Directory (AD) credentials. Specifically, when a user's password has expired and Fortinet prompts them to create a new one, the portal fails to validate whether the new password complies with AD's complexity requirements.

As a result, Fortinet provides a confirmation that the password has been successfully changed, despite the update not being propagated to the AD. This discrepancy causes users to believe their password has been updated, when in reality, the original password remains active. Consequently, users frequently contact support after being unable to authenticate using their "new" password.

Is there a way to enforce AD password policy compliance directly within Fortinet or otherwise mitigate this issue to reduce user confusion and support overhead?

[pminarik]

The FortiGate has no knowlege of password complexity on the remote LDAP server, but if the change fails, it should be propagated as an error response to the password change attempt in the LDAP protocol. It's not expected to fail silently.

Check if the permissions are correct, and maybe do a test with an expired account via CLI.

Relevant doc: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Enable-expired-password-LDAP-renewal-with-...