Interoperability: FortiAnalyzer/FortiManager 7.4+ Login Failures with CA PAM

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

When using automation tools, credential injection engines, or Privileged Access Management (PAM) platforms (such as Broadcom/CA PAM) to log into FortiAnalyzer (FAZ) or FortiManager (FMG) versions 7.4.x, 7.6.x, or 8.0.x, the following issues may occur:

• Login fields appear to fill visually but clear immediately upon clicking 'Login'.
• Error messages indicating "empty field" or "validation failed" even though credentials were typed.
• The automation engine fails to submit the form successfully.
• The logins to these applications was working before these were upgraded to the latest build

Environment

CA PAM: Versions 4.2.x and above

Cause

React JS & State Management

Fortinet has migrated the web management portals for these versions to the React JS framework. This transition changes how data input is handled compared to legacy HTML portals:

1. The Virtual DOM: React maintains a 'Virtual DOM' in memory. It does not rely on the standard browser Document Object Model (DOM) for data tracking.
2. State Desync: Legacy automation tools typically inject credentials using standard HTML setters (e.g., document.getElementById('username').value = 'admin').
3. The Conflict: While the HTML setter changes the visible text on the screen, it bypasses React's internal state management. Because React's internal state remains empty (""), the application behaves as if no data was entered when the submit button is triggered.

Resolution

To resolve these interoperability issues, CA PAM platform must ensure that React's internal state is updated. Use one of the following methods:

1. Upgrade PAM Platform/Jump Host

Broadcom/CA PAM credential vaults have released cumulative patches to address React JS input overrides. (This is fixed from CA PAM Version 4.1.5+)

• Action: Ensure your CA PAM application is running the latest maintenance release. These updates often swap legacy HTML setters for React-compatible event dispatchers automatically.

2. Utilize Modern "Learn Mode" Recorders

• Action: Re-record the login sequence for the 7.4+ portals using the Learn Mode for the Webportal. Modern recorders are designed to trigger input or change events that React listens to, forcing the Virtual DOM to sync with the injected text.

Additional Information

The above applies for all the Web portals that make use of React JS.