RSSO in 6.2.3 doesn't define "user group" in policy
Hello everyone,
We have FG300 with FortiOS 6.2.3 and Freeradius. Use RSSO to authorize WIFI users. The user falls into the group on FG, but it is not defined in the policy and, accordingly, the policy does not work. We need help, which may be the reason.
FortiGate # dia test app radiusd 3
RADIUS server database [vd root]:
"index","time left","ip","endpoint","block status","log status","profile group","ref count","use default profile"
1,07:58:42,"192.168.51.10""host/ARM0796.lokb.spb.ru","allow","no log","<default profile>",1,Yes
2,07:59:57,"192.168.57.4""ushakov","allow","no log","usersLOKB",1,No
FortiGate # sh user radius RSSO\ Agent
config user radius
edit "RSSO Agent"
set rsso enable
set rsso-radius-response enable
set rsso-validate-request-secret enable
set rsso-secret "secret"
set rsso-endpoint-attribute User-Name
set rsso-flush-ip-session enable
set rsso-ep-one-ip-only enable
next
end
FortiGate # sh user group RADIUS\ users
config user group
edit "RADIUS users"
set group-type rsso
set sso-attribute-value "usersLOKB"
next
end
Received radius accounting eventvd 0:root Add/Update auth logon for IP 192.168.57.4 for user ushakov
DB 0 insert [ep='ushakov' pg='usersLOKB' ip='192.168.57.4/32'] success
User is visible in Monitor > Firewall User Monitor as the rsso user, but policy doesn't work