FSSO Radius and AD Group membership

[lorenzo_mao]

Hello,

  I've several rules configured on fortinet that are based on AD groups.

those Rules are working correctly for wired devices.

I use radius (MS NPS) for autenticate users on WiFi (Managed FortiAPs)

I use radius for VPNSSL auth too.

when a user is authenicated trough the radadius I've no group membeship info so that the rule based on AD groups are not working.

Is there any way to combine username from radius with groups from AD?

Thanks

Lorenzo

[xsilver_FTNT]

Hi Lorenzo,

if you are authenticating users of WiFi and VPN against NPS via RADIUS, then maybe you can sent RADIUS Accounting to FortiGate and use something we call RSSO (RADIUS Accounting based SSO).

So if you pair your AD groups into strings returned back to FortiGate as RADIUS Accounting AVP defined in 'config user radius / edit "Your-RADIUS-Acct-Provider"/ set sso-attribute' and then you pair those to sso-attribute-value defined in 'config user group' for groups type rsso, then you will be able to use this group match mechanism to pair Windows AD groups to firewall groups on FortiGate and use those in policies.