Technical Tip: Understanding the user licensing on FortiAuthenticator

Description

This article describes a basic explanation about how the FortiAuthenticator handles user licensing when have multiple user schemes like local users, LDAP, RADIUS, SAML, etc.

Scope

FortiAuthenticator.

Solution

Many users consult with the Technical Support Team about how FortiAuthenticator handles the licenses for users.

When users purchase a user license for FortiAuthenticator, keep in mind that FortiAuthenticator considers users as objects. In consequence, FortiAuthenticator could stop working in some features, like remote user sync rules.

In this example, the license bundle includes just 3100 users (maximum allowed).

FortiAuthenticator considers all users.

That means the quantity of objects is equal to the quantity of users, object = user.

If creating the SAML username 'martin' on the SAML server and importing the same user as LDAP. FortiAuthenticator will consider that it has two different users.

The user license count is also explained in the administration guide and the release notes for FortiAuthenticator. Note also that FortiClient Mobility Agent (SSOMA) users from that screenshot, listed as 'FortiClient Workstation' need a separate, additional license.

Documentation for licensing:

• Maximum values for VM

• Licensing

Note also that on version 8.0 and above the licensing model has changed to include a subscription based license. The licensing now also does not statically count against imported users, but against the users that produced logins. See the documentation about Licensing in the later Administration guide for more information.