What is Purpose of the Minimum Privilege for MSCHAPv2

[chinlong]

Hi All,

I found that there is minimum privilege AD user account for MSCHAP2/PEAP authentication from Fortinet guide (Create All Child Objects, Write All Properties, and Change password under Computer Objects). But I would like to know why these permissions are needed in order to complete the authentication process?

Link: LDAP | FortiAuthenticator 6.6.1 | Fortinet Document Library

FortiAuthenticator 

[ebilcari]

Due to the nature of the authentication protocol, FAC has to emulate a domain joined windows PC login using Winbind. A similar technique is used by many vendors. You can take a look at this article to have more information.

[chinlong]

But without providing the permission, I am able to authenticate successful too. So, I am confusing why are the permissions are needed and is there any feature of FAC will not be able to use if I not allowing the permission?

[ebilcari]

My knowledge of AD/DC is a bit limited but I guess the domain join procedure may need the two first permissions. Did you remove those permission after FAC has joined the domain?
The password change permission is used when the end user's password has expired and need to be changed from a login method like RADIUS or portal.

[chinlong]

No, what I did is just create a new domain user without any permission. Then remove the old FAC computer in AD and everything go smooth. So, it seems like the permissions don't relate to the MSCHAp2/PEAP authentication, but will it relate to other features in FAC?