Technical Tip: FortiGate Okta RADIUS Group-Based admin authorization failing

To resolve group matching failures, verify the following configuration points:

1. Verify Okta RADIUS attributes: Ensure the Okta RADIUS agent is configured to send group membership. FortiGate primarily supports Filter-Id (11) and Class (25) attributes for group mapping.
   
   
2. Configure FortiGate attribute matching:

The FortiGate must be told which attribute to look for. Set the group-override-attr-type to match the related Okta configuration (usually filter-id).

config user radius

    edit <server-name>

        set group-override-attr-type filter-id

    next

end

3. Validate the authentication flow:

Use the following diagnostic command to see exactly what attributes Okta is sending in the Access-Accept packet:

diagnose test authserver radius <radius_server_name> <auth_scheme> <username> <password>

Note: If the group name in the debug output is visible but authorization still fails, verify that the group name on FortiGate exactly matches the string in the RADIUS packet (including case sensitivity).

4. Connectivity: Ensure that the username and group name case consistency between Okta and FortiGate is maintained, and verify that the RADIUS secrets and ports match on both sides. Confirm that the Okta RADIUS agent is sending the correct group attributes.

    

For more information, refer to the document: Support for Okta RADIUS attributes filter-Id and class.