FortiManager Workflow

Forum|Forum|10 years ago
August 31, 2015
6 replies
12164 views

Trying to configure the workflow in Fortimanager. Configured an admin account to authenticate using LDAP and assigned him permission to approve a session but it does not seem to work.

However if i change the auth type for the admin user to local then he can approve changes.

Does fortimanager have any such limitation?

FortiManager VM

Best answer by scao_FTNT

in 5.2.4, we fixed issue for neonbit mentioned Scenario 1, admin has right click menu approve function, but click approve can not approve the session properly. So after approve, GUI still see the session in 'waiting for approval status'. Next time approval will see an error popup "Approval failed as it has already been approved by qa1. No further action required"

but we also noticed sometimes, remote admin login can not see approve option (and reject/discard) in right click menu, and if customer is seeing the issue, this one is not yet fixed in 5.2.4 and we are still investigating this issue.

Thanks

Simon

scao_FTNT

Staff

which FMG version you are using?

Thanks

Simon

neonbit

New Member

I've tested this using a RADIUS account (FMG-VM 5.2.3) and it's not working.

When I approve the changes with aRADIUS admin, it doesn't save. IE: the icon still says awaiting changes.

If I log out and back in with the local admin and approve the changes they save correctly and can be applied.

neonbit

New Member

Further testing with this;

I've got three users:

admin (local, superuser)

radius-admin (remote, custom profile with full write permissions)

support (local, standard user)

Admin and radius-admin have been configured with workflow approval to the adom, support doesn't have these permissions.

Scenario 1: support makes a change and requests approval. radius-admin has the option to approve this change, but the option doesn't save correctly (looks like a bug?). Admin is able to approve the change and it saves correctly.

Scenario 2: radius-admin makes a change and requests approval. Radius-admin can approve this change and it saves correctly.

So from what I've tested it seems that remote admins are unable to approve other users requests, but approving their own requests works fine.