Hot!FSSO Radius and AD Group membership

Author
lorenzo.mao
New Member
  • Total Posts : 1
  • Scores: 0
  • Reward points: 0
  • Joined: 2019/04/01 02:30:35
  • Status: offline
2019/04/01 02:42:13 (permalink) 5.6
0

FSSO Radius and AD Group membership

Hello,
  I've several rules configured on fortinet that are based on AD groups.
those Rules are working correctly for wired devices.
 
I use radius (MS NPS) for autenticate users on WiFi (Managed FortiAPs)
I use radius for VPNSSL auth too.
 
when a user is authenicated trough the radadius I've no group membeship info so that the rule based on AD groups are not working.
 
Is there any way to combine username from radius with groups from AD?
 
Thanks
Lorenzo
#1
xsilver
Expert Member
  • Total Posts : 444
  • Scores: 99
  • Reward points: 0
  • Joined: 2015/02/02 03:22:58
  • Location: EMEA
  • Status: offline
Re: FSSO Radius and AD Group membership 2019/04/01 06:24:51 (permalink)
5 (1)
Hi Lorenzo,
if you are authenticating users of WiFi and VPN against NPS via RADIUS, then maybe you can sent RADIUS Accounting to FortiGate and use something we call RSSO (RADIUS Accounting based SSO).
So if you pair your AD groups into strings returned back to FortiGate as RADIUS Accounting AVP defined in 'config user radius / edit "Your-RADIUS-Acct-Provider"/ set sso-attribute' and then you pair those to sso-attribute-value defined in 'config user group' for groups type rsso, then you will be able to use this group match mechanism to pair Windows AD groups to firewall groups on FortiGate and use those in policies.

Kind Regards,
Tomas
#2
Jump to:
© 2019 APG vNext Commercial Version 5.5