Problem In Totp using for SSL VPN fortinet+Radius

Question
1

Dears,

I’m already configured PrivacyIDEA and PrivacyIDEA FreeRaduis, and integrate it with AD LDAPs , then integrate it with Fortinet …

In testing it was work fine while use totp tokens to access remotely using fortinet vpn clinet ..

Using password format : AD user password+otp.

After go live , users are facing the random problem , a lot failed authentication.with error :

ERR907: invalidCredentials (49)،. And lockout AD user immediately.

When test token access from PrivacyIdea Dashboard by enter password+otp it’s working fine , and when trying to test authentication from Fortinet management dashboard, it’ s wokring fine

I make sure the NTP setttings are configured correctly, but the authentication sometimes working for first login , but failed a lot time , after investing, I’m trying to change policy to be otppin=none , it’s wokring fine but doesn’t secure …

BR,

Hazem Mohamed

2

Thank you for choosing privacyIDEA.

To analyze the problem you have to ask,

  1. what are the conditions that a user gets locked in AD?
  2. what does the VPN do and what does privacyIDEA do (I can help you with that)
  3. and how can these conditions occur?

Looking forward to your response and at least answer of the first question.
Regards
Cornelius

3

Dear CorinLinux,

Thanks for your response.

I’m found the resolution in the below question: