The core issue is the incompatibility between the MSCHAPv2 authentication protocol and the FortiAuthenticator's LDAP server configuration. MSCHAPv2 is a challenge-response protocol and does not transmit the user's clear-text password. The exhibit shows the FortiAuthenticator's LDAP connection to Active Directory is configured with Authentication type: Simple. A simple LDAP bind requires the clear-text password to authenticate the user, which explains why PAP authentication succeeds. To support MSCHAPv2 against an Active Directory backend, FortiAuthenticator must use a method that can handle challenge-response authentication. Enabling Windows Active Directory Domain Authentication allows FortiAuthenticator to properly communicate with the domain controller to validate the MSCHAPv2 credentials.

A. Changing the RADIUS authentication protocol to CHAP will not resolve the issue, as CHAP is also a challenge-response protocol and is incompatible with a Simple LDAP bind.

C. Manually adding users to the local database is a workaround that bypasses the intended authentication against Active Directory and is not the correct solution.

D. RADIUS attributes are used for authorization policies after a user has been successfully authenticated; they cannot fix a failure in the authentication process itself.

1. FortiAuthenticator 7.2 Administration Guide, Page 118, Section: "Authentication > Remote Auth. Servers > LDAP". The guide describes the LDAP server settings. It explains that a Simple bind uses the user's credentials to bind to the LDAP server, which implies clear-text password availability. For challenge-response protocols like MSCHAPv2, a different mechanism is required. The guide states, "For MS-CHAP-V2 authentication, the FortiAuthenticator must join the AD domain," which is facilitated by the Windows Active Directory Domain Authentication setting.

2. Fortinet Cookbook - FortiAuthenticator, Recipe ID: FD53008, "Technical Tip: How to configure FortiAuthenticator as a RADIUS server for 802.1X wireless authentication". This document outlines the configuration steps. In the section for configuring the remote LDAP server, it specifies that to support MSCHAPv2 for wireless clients authenticating against Active Directory, the FortiAuthenticator must be configured to properly interact with the domain, which is not possible with a Simple bind.