Technical Tip: Using the FortiGate API to retrieve the RADIUS or TACACS+ secret key

Description

This article describes how to recover the RADIUS or TACACS+ secret key via the FortiGate CLI.

Scope

FortiOS.

Solution

If the secret key for a RADIUS or TACACS+ server is forgotten, it is possible to view the decrypted form by querying the FortiGate's API.
The query will be done with '?plain-text-password=1', similar to what is done to see the IPsec PSK:
Technical Tip: Use the FortiGate API to recover an IPsec pre-shared key in plain text format.

The correct path to query for RADIUS would be as follows:

https://[FortiGate IP]/api/v2/cmdb/user/radius/[RADIUS server name]?plain-text-password=1

This is the output without '?plain-text-password=1', the secret is encrypted:

This is the output with '?plain-text-password=1', the secret is visible:

The correct path to query for TACACS+ would be as follows:

https://[FortiGate IP]/api/v2/cmdb/user/tacacs+/[TACACS+server name]?plain-text-password=1

Encrypted output:

Decrypted output: