Technical Tip: Local user, username case sensitivity and accent sensitivity
Description
This article describes the option to disable username case sensitivity for all types of local users.
Scope
FortiGate.
Solution
By default, remote LDAP and RADIUS user names are case-sensitive.
When a remote user object is applied to SSL VPN authentication, the user has to type the exact case that is used in the user definition on the FortiGate.
The ' set username-case-sensitivity’ CLI command can disable case sensitivity, allowing the remote user object to match any case the end user types in while logging.
To disable case sensitivity for individual users use the following command.
config user local
edit "<name>"
set type <ldap|radius>
set username-case-sensitivity disable/enable
end
- disable: Ignore case and accents. The username at the prompt is not required to match the case or accents.
- enable: Do not ignore cases and accents. The username at the prompt must be an exact match.
To match accented characters (for example: 'ě' instead of 'e' and other few characters ščřžýáíéúů), which are present in many non-English languages, the existing option 'username-case-sensitivity' has been changed to 'username-sensitivity'.
This new option includes both case sensitivity and accent sensitivity. When disabled, both case and accents are ignored when comparing names while matching the local user.
config user local
edit "<name>"
set username-sensitivity ?
enable <---- Do not ignore cases and accents. The username at the prompt must be an exact match.
disable <---- Ignore case and accents. The username at the prompt is not required to match the case or accent.
end
Notes:
- If the user's password is stored locally (set type password), the option to enable or disable username-sensitivity will not be available.
- The user case sensitivity is only available per user setting; a global configuration for case sensitivity is not available.
- There is a known issue reported under bug ID 1180629, which features the warning 'Username sensitivity is disabled. Capitalization and special characters will be ignored and MFA requirements may potentially be bypassed'. This is displayed incorrectly in the GUI when disabling username-sensitivity.
This issue has been resolved in:
- v7.4.10 (available to download from the Fortinet Support portal). Refer to bug ID 1180629 in the Resolved issues.
- v7.6.5 (available to download from the Fortinet Support portal). Refer to bug ID 1180629 in the Resolved issues.
- v8.0.0 (scheduled to be released in March 2026).
These timelines for firmware release are estimates and may be subject to change.
Related articles:
Technical Tip: SSL VPN two factor authentication (2FA) is bypassed when user enters username that is not an exact case match
Technical Tip: Configuring Remote LDAP users with Two-Factor Authentication