Skip to main content
samandeep
Staff
samandeep
Staff
July 28, 2024

Technical Tip: 'This FortiCloud account XXXX is not authorized to sign in on this FortiGate' via accessing FortiGate cloud from a new master FortiCloud account

  • July 28, 2024
  • 0 replies
  • 3422 views
Description

This article describes that new IAM users will not be able to remote access the on-prem FortiGate via FortiGate Cloud and getting this error 'This FortiCloud IAM user does not have permission to sign in on this FortiGate'.
Scope FortiGate, FortiCloud.
Solution

The FortiGate can be configured to allow administrators to log in using the FortiCloud IAM user account. This option can be enabled on the FortiGate GUI under the System -> Settings -> FortiCloud SSO which will allow single sign-on login to the FortiGate using the FortiCloud IAM user account.

 

sso_enable.png

 

sso_login1.png

 

If the new IAM user is unable to log in to the FortiGate, showing a similar error as below, the possible cause of this issue is that the IAM user account does not have valid permissions to access the FortiGate.

 

sso_login2.png

 

To allow the login access to FortiGate using the IAM user account:

 

forticloud1.png

 

  1. Log in to the Fortinet Support portal and go to Services -> IAM.

  2. Select Permission Profiles.

  3. Create a new permission profile (Note: the default sysadmin permission profile does not have FortiGate Cloud portal enabled).

forticloud2.png

 

  1. Select to Add Portal.

     

  2. Select portals based on the requirement, but for accessing on-premise FortiGates, FortiOS SSO, and Managed FortiGate portals must be added to allow FortiCloud SSO access for administrators.

     

    fortilcoud7.png

 

  1. Enable access on both portals and select the Access Type as required.

    fortilcoud4.png

     

  2. Assign this Permission Profile to the new IAM user.

  3. Ensure the status of the IAM user is Active.

  4. Log in to the support portal via the new IAM user account to verify access.

Screenshot 2024-10-18 150403.png

 

Log in to the FortiGate using the IAM user account.


After assigning the necessary Permission Profile to the IAM user account, a successful login attempt to the FortiGate will show the following:

 

sso_login3.png

 

To verify the current SSO administrator session, go to Dashboard -> Status -> Show active administrator sessions.

 

forticloud.sso.png

 

admin_session.png

 

Note:

If the configuration is the same as described in this article and the FortiCloud SSO user account still shows as unauthorized, review whether the device license is set to 'Pay as you go'. At this time, 'Pay as you go' is not supported by FortiCloud SSO login. 
      Terms & ConditionsAccessibility statement