1200D Two Factor Auth

Hi,

from your need for email address, 2FA and FortiGate, I guess you are talking about FortiToken Mobile.

FortiGate is not designed as complete authentication center. And therefore 2FA tokens are bonded to locally defined, regardless they are type remote, "locally defined" because tokens are set on FortiGate and bonded to users _on_ FortiGate.

The FortiGate is unable to automatically synchronize users from LDAP, none of their properties, including email addresses. Nor assign tokens to them. And therefore token assignment and required email address needs to be set manually by admin.

If you do have tens, or small hundreds of users, then it will be a bit laborious. FortiGate does have CLI, plain text config .. use scripts to automate this process.

If you do have bigger environment, hundreds of users, users moving in and out of the organization, changing their positions/group-membership. Then I would suggest to start thinking about FortiAuthenticator, which is authentication/authorization concentric platform.

It is capable of ..  - automatic user synchronization from LDAP according to defined LDAP filters, in defined time cycles

- automatic group assignment and RADIUS AVP parameters setup according to sync rules, later usable for multiple auth clients like FortiGates, FortiAPs, or even 3rd party RADIUS capable devices like routers, switches, 802.1x...

- automatic token provision from those sync rules, and so email retrieval from configurable LDAP field - users removed from LDAP, not matching filters anymore can be removed and tokens reclaimed back to pool

- token self service portal available, to report lost token or re-provision token to new/replacement mobile device

- usage enforcement, captive portals, guest management, Single Sign-on (SSO) .. 

... and lot lot more!

Hope this helped to get an idea.

I wrote also reddit fortigate page message is here

It would roughly boil down to something like (pseudocode):

ad_users = query_ad(mydomain) for user in ad_user: fgt.api.post(/user/local/).body({ ‘name’: user[‘sAMAccountName’], ‘type’: ‘ldap’, ‘two-factor’: ‘email’, ‘email-to’: user[‘smtp’] })

how can I use this pseudocore? I think fgt.api required but I dont find any resources for usage.