Producent rozwiązań Fortinet udostępnił wersję FortiAuthenticator 8.0.4, która koncentruje się na poprawie bezpieczeństwa oraz niezawodności mechanizmów uwierzytelniania. Aktualizacja eliminuje między innymi błąd umożliwiający niektórym użytkownikom o identycznych nazwach logowanie do poczty przez agenta OWA bez weryfikacji 2FA, problem z brakiem odpowiedzi na żądania uwierzytelniania RADIUS po przełączeniu klastra HA oraz błąd powodujący wyczerpanie dostępnych połączeń z bazą danych i brak odpowiedzi systemu przy dużej liczbie żądań SAML. Poprawki zwiększają ochronę dostępu do usług i zapewniają większą stabilność środowiska.
Rozwiązane problemy:
| Bug ID | Description |
|---|---|
| 953185 | Unable to configure (-) in the certificate ID field. |
| 973414 | Downloading large Summary Debug Report from GUI leads to Gateway Timeout Error. |
| 1107132 | Support Alcatel-ESAM RADIUS dictionary. |
| 1135456 | FTM self-provisioning portal page is shown as blank for some users. |
| 1186398 | Lost AES support in SCEP (due to MS incompatibilty). |
| 1198353 | SCEP with aes-256-cbc fails with decryption. |
| 1198648 | Remote RADIUS user password change fails from self-service-portal/admin-portal. |
| 1199749 | LDAP user password change through RADIUS/User Portals does not work on Windows Server 2025 Domain Controller. |
| 1212035 | Automatic CRL download does not verify validity period. |
| 1223664 | Cross-Origin-Opener-Policy: same-origin breaks OIDC compatibility with vault. |
| 1224319 | Filter for 'All’ certificates button does not display revoked certificates. |
| 1229686 | Changing default static route causes HA LB to stop synchronizing. |
| 1232308 | Unable to change admin password through CLI on Azure VM Marketplace instance with SSH Key. |
| 1232741 | If CRL is expired, EAP-TLS still uses it to check client certificate instead of reject the client certificate. |
| 1232772 | SubjectAltName has all values in one line separated by comma. |
| 1234168 | Changes to remote LDAP sync rule settings while the rule is running may be overwritten. |
| 1235550 | Change OIDC discovery endpoint to standard path. |
| 1236866 | Incorrect/misleading error message when trying to import remote SAML users with misconfigured SAML server settings. |
| 1237340 | FortiAuthenticator should reject connecting to secure syslog server missing id-kp-serverAuth (1.3.6.1.5.5.7.3.1) in its certificate. |
| 1238176 | Certificate issuer is blank on remote SAML server and SAML Service Providers page. |
| 1238274 | SCIM getting 400 errors when trying to add user on Palo Alto Prisma (SCIM SP). |
| 1244205 | FortiAuthenticator not returning the Access-Control-Allow-Origin header in HTTP responses. |
| 1244672 | 500 Internal Server Error if injecting very long parameter value into the password reset page. |
| 1245914 | Custom Vendors RADIUS Dictionaries not syncing to LB node. |
| 1247171 | SAML IdP User source setting 'search local users first’ has no effect for SAML realms (IdP proxy). |
| 1252254 | SCEP fails to sign FortiGate CSR when subject includes a serial number. |
| 1257765 | TACACS+ service may fail to restart after configuration changes. |
| 1257974 | Logging to FortiAnalyzer Cloud fails due to missing SNI. |
| 1259508 | Stale legacy self-service portal settings left behind after upgrade from 6.x. |
| 1259634 | Synchronization with Entra ID SAML takes too long. |
| 1260534 | 500 error when trying to reset the admin password via email. |
| 1261769 | Relax redirect URI scheme validation constraints for Relying Parties. |
| 1262280 | Error during captive portal user registration under high load. |
| 1264703 | FSSO randomly stops performing group lookups for SSOMA on native Entra ID-joined workstations. |
| 1265223 | Self-service password reset does not work if using hardware FortiTokens. |
| 1265879 | IdP Proxy: Local authorization groups not included in assertion. |
| 1266052 | Local Users GUI page should show the count of local user accounts only. |
| 1266463 | Importing users from LDAP server by group membership shows stale user accounts info. |
| 1267154 | 500 error when trying to revoke user certificate. |
| 1270122 | api/v2/samlidpusersources– Improve descriptions and validation. |
| 1271131 | REST API v2 should accept URLs with or without a trailing slash. |
| 1271803 | Unable to sync more than 500 users using a Google SAML server. |
| 1272491 | Certificate policies are not displayed correctly when viewing certificate details. |
| 1272893 | FortiAuthenticator 500 internal server error when uploading CSR. |
| 1273564 | Smart Connect EAP-TLS Profile fails to install on macOS. |
| 1274773 | Re-importing a certificate using /api/v2/servicecerts/import fails silently. |
| 1275165 | RADIUS sessions sort option does not sort. |
| 1275356 | Adding local user with LDAP auto-provisioning fails when LDAP service directory tree contains large number of users. |
| 1275478 | Unnecessary geoip update attempts generate noise in the logs. |
| 1275900 | FortiAuthenticator IP lockout exemption for 0.0.0.0/32 not working leading to global WiFi authentication lockouts. |
| 1276336 | Customer wants to use UPN on their FSSO setup, but FortiAuthenticator fails to search LDAP, thus no FSSO logons are shown. |
| 1276949 | FortiAuthenticator exposes challenge password in SCEP debug logs. |
| 1277309 | /api/v2/servicecerts– Unable to delete a certificate with ID of 2 or 3. |
| 1277386 | Inoffensive but worrisome runtime warnings in radsecproxy debug logs. |
| 1277504 | Internal Server Error: /api/v1/oauth/logout/. |
| 1278857 | 403 Forbidden error when trying to change password from self-service portal if the admin UI access is disabled. |
| 1279225 | REST API authentication uses case-sensitive check of username. |
| 1280318 | Rare deadlock between HA replication and web server processes. |
| 1280983 | The GUI error message shows a float instead of an integer (days) of validity period when allowing SCEP renewal before expiry is enabled. |
| 1281867 | PSU shows Voltage Input Fault at 241V.
Acceptable range is too strict |
| 1282471 | Getting error when trying to lock, disable, or re-enable a guest user. |
| 1282907 | Typo in REST API response to create new user: 'status’ is misspelled 'statue.’ |
| 1283157 | FortiAuthenticator-300G – Support displaying single power supply in web GUI HW monitor. |
| 1284484 | SAML user sync does not clean up the lock file on exception. |
| 1284756 | Delivery options on the captive portal are not working. |
| 1286236 | FTM assigned via self-service portal in 'Assigned’ state even if provisioning is never completed. |
| 1287775 | New hardware models supported: FortiAuthenticator 300G and 800G. |
| 1288770 | Intermittent GUI and SAML authentication failures due to /tmp/sessions file leakage. |
| 1288905 | Error when importing learned RADIUS users. |
| 1290269 | Default VM templates do not require enough memory (2GB instead of 16GB). |
| 1290959 | Self-service portal resets when user tries to reset password using 2FA. |
| 1290967 | SAML authentication fails when SAML request does not include X509Certificate. |
| 1292583 | REST API responses with config object relative URI references are missing trailing slash. |
| 1293385 | [NFR] REST API: Admin password changes. |
| 1293743 | Reduce OAuth Authorization Code Maximum Lifetime. |
| 1294042 | OIDC JWT token omitting filter-based LDAP group when user object is nested in a deep OU. |
| 1294138 | Read only admins should not be able to do ftp/tftp transfers. |
| 1294191 | CLI is displaying incorrect bonded interface information. |
| 1294353 | FTM in pending state even if failed to send activation message. |
| 1294802 | ’Response Timeout’ setting for FortiAuthenticator as LDAP client applies to TCP connect, but not to LDAP search query. |
| 1296087 | REST API PATCH method on localapiadmin clears some attributes. |
| 1296871 | User license usage exceeds actual user count on FortiAuthenticator after upgrade from 6.6.2 to 8.0.3. |
| 1298023 | Sending system logs to remote syslog server through TLS may cause FortiAuthenticator to hang/stall if the server is unavailable. |
| 1298249 | RADIUS authentication not responding after HA cluster failover. |
| 1298280 | Response from creating single local user via REST API is not backward-compatible with earlier releases. |
| 1298845 | FortiAuthenticator OWA agent allows web mail login without 2FA for some users having same username as another user. |
| 1300742 | Generate system log event when an localapiadmin password is changed. |
| 1301661 | 500 error when assigning FTM if email template includes reference to a missing image. |
| 1304595 | IPv6 addresses mishandled by adaptive MFA rules. |
| 1304822 | api/v2– Admin with certificate management write permission cannot update. |
| 1305246 | FortiToken prompt displays the domain name(realm) twice when Azure Entra ID is configured as proxy. |
| 1305684 | FortiToken Mobile transfer does not work. |
| 1306166 | Smart Connect not working with Android devices if EAP server certificate CA is different from the end-user certificates’ CA. |
| 1306356 | „LDAP directory group” and „LDAP filter (advanced)” fails with error "fac_auth_facgroup" violates not-null constraint" |
| 1306972 | Some ports are missing in Hardware models. |
| 1307157 | ACME certificate renewal fails due to EC curve error. |
| 1307168 | Slow SAML IdP login with large number of local users. |
| 1307172 | Unable to add certificate for 'SAML request must be signed by SP’ when subject and/or issuer contains trailing whitespace. |
| 1307780 | ’Understanding the captive portal workflow’ button is broken. |
| 1308242 | LB HA: YubiKey/HOTP token counters not updated and synced back to primary after login on LB node. |
| 1308947 | Remote auth server SAML logout failing with Microsoft Entra ID. |
| 1309022 | Usage Information section of individual user edit pages only shows first active session found, not the sum of all. |
| 1310756 | Error 500 when trying to use Smart Connect Windows/Android app that does not support ECC certificates. |
| 1311493 | 500 error in FortiAuthenticator IdP proxy after successful authentication if FortiAuthenticator detects errors in assertions of external IdP response. |
| 1311601 | Unsigned SAML logout requests sent to remote SAML servers. |
| 1312107 | Local user CSV export API cannot filter on username. |
| 1313551 | SCIM created groups with hyphens cannot be edited. |
| 1314264 | Unable to restore admin access when interface is bonded. |
| 1314270 | 403 error in admin GUI after breaking bond interface. |
| 1315238 | Restore the automatic 'Get trial FTM tokens’ logic for both FortiAuthenticator Cloud and unlicensed VMs. |
| 1315401 | 50 entry hard code limit on SAML assertion attributes proxied from remote SAML server to SP. |
| 1315717 | FortiAuthenticator-VM in Azure may lose configuration upon reboot on instance sizes that include 'temporary storage disks’ unless 16GB. |
| 1315738 | Disallow subject DN of issuer == subject DN of a cert when creating server cert/user cert in FortiAuthenticator. |
| 1316311 | HTTP 500 Error occurs when SAML request signing uses ECC certificate in the IdP proxy. |
| 1316499 | No FortiAuthenticator AMI exists in AWS ca-west-1 marketplace. |
| 1316887 | Performance improvement for AD authentication. |
| 1316899 | Deadlock detected when inserting OU under LDAP directory tree. |
| 1316901 | SAML IdP response signing fails when an ECC certificate is selected as the server certificate. |
| 1319427 | Importing unsupported custom RADIUS dictionary leads to admin UI lockout. |
| 1319598 | FDN/FortiGuard SSL communication failure on FortiAuthenticator 300G and FortiAuthenticator 800G models; unable to register trial tokens. |
| 1319844 | 500 Internal Server Error after upgrading to 6.6.10. |
| 1319969 | Internal Server error while creating RootCA with the 'Use netHSM server’ option enabled. |
| 1320189 | /api/v2/remotesamlservers permissions cannot be controlled by Admin Profiles. |
| 1320567 | openid scope must be rejected for password-based OAuth token requests. |
| 1322562 | High SAML requests cause the database to run out of connections and become non-responsive. |
| 1322845 | Intermediate root CA fails when exporting PKCS12 with error Cannot export PKCS#12 certificate. |
| 1326019 | api/v2– name__in query parameter does not work. |
| 1326485 | SAML excludes LDAP custom attributes when 'Secure Connection’ is enabled. |
| 1327926 | Realm attribute is not returned from user info endpoint. |
| 1330473 | Possible SCIM client race condition when moving user between groups. |
| 1331223 | Improve OIDC discovery metadata. |
| 1332243 | Request ID (X-Request-ID) present in FortiAuthenticatorlogs is not propagated to FortiAnalyzer logs. |
| 1338048 | Secure connections to Azure SMTP server are denied. |
| 1340846 | SCIM user update from Entra ID do not work when username contains uppercase letters. |
| 1344950 | Cisco ASA (AnyConnect SSL VPN) client radius authentication is failing against FortiAuthenticator (missing authenticator attribute). |
| 1352143 | SCIM maximum groups sync limit per RP from 128 to 256. |
The following issues were introduced during 8.0.4 development and were not present in 8.0.3 GA; they affected only systems that had upgraded to 8.0.4 build 0187 and are resolved in this release.
| Bug ID | Description |
|---|---|
| 1313622 | Admin Profiles require at least one permission in custom permission sets. |
| 1331705 | Checkbox/toggle labels not toggling the control on clicking the Neutrino pages. |
| 1346481 | AWS FortiAuthenticator upgrade resets the 'admin’ account password to the instance ID. |
| 1353513 | RADIUS client IP range migration fix. |
| 1353607 | Fix UI components missing in system access. |
| 1353964 | User cannot login using username@fortinet.com for FIDO enabled SAML entries. |
| 1353977 | SAML SP with password and FIDO does not work, but works with FIDO-only. |
| 1354789 | 500 error when searching for locked out user. |
| 1356716 | Unable to download IDP metadata from metadata URL. |
Notatki producenta: FortiAuthenticator 8.0.4 release notes
Pozdrawiamy,
Zespół B&B
Bezpieczeństwo w biznesie