Technical Tip: How to fix 'user not filtered by groups' error
| Description | This article describes how to fix a 'user not filtered by groups' error. |
| Scope | FortiAuthenticator 6.x. |
| Solution | If the following failure message appears in the logs at Log Access -> Log Access -> Logs go over to radius debug for more details.
Local administrator authentication with no token failed: user not filtered by groups
Access the following and look for the same error (it may be necessary to enable the RADIUS debug mode with the debug button): https://fac-ip/debug/radius/
fortiauth radiusd[1256]: (57) Received Access-Request Id 3 from 10.191.48.149:12668 to 10.5.48.234:1812 length 121
Check if the correct radius policy has been matched.
Make sure the affected user is a member of the group/groups defined/imported on the FortiAuthenticator. For example:
Result
... Message Local administrator authentication with no token successful ... ... fortiauth radiusd[1256]: (62) facauth: Updated auth log 'user1': Local administrator authentication with no token successful ...
Note:
The users cannot have a 'Pre-Windows 2000 Compatible Access Group' membership. For more information, see these Microsoft document links:
Related article: Troubleshooting Tip: How to work with FortiAuthenticator Technical Support |
