FortiNAC, AD user cannot override itself if created by RADIUS

Normally, during authentication an LDAP query is performed to retrieve the user information and create the user account with the ‘Loaded from Directory’ status and all the user attributes.

Does this issue affect all or only specific users? Do the affected users have any special characters in their attributes? How is the user automatically created later on, do they later authenticate through the portal or the persistent agent?

Have you tried to reproduce the issue with these debugs on:

fnac # diagnose debug plugin disable DirectoryManager
fnac # diagnose debug plugin disable DirectoryAuthentication

There are a few similar issues reported for this firmware (like 1194498) but the fixes are included only in the other supported release branches.

As far as I know, there is no way to force user synchronization or preload directory users into FNAC. I'm also not certain how a manual CSV import would behave for users that are found in the directory. As a last resort they can be created manually, one by one in Users.

Hi Emirjon

Thanks for your feedback.

This happens only for “new” users (on PC with PA) that connect for the first time via WiFi before connecting via wire network. When I see new users I also confirm that we synced FNAC with AD before the test.

On the other hand if one “new” user connects for the first time on wire network before WiFi, the FNAC adds him as Directory user, that’s logic because the user is not added by RADIUS. And then if the same user connects via WiFi all works just fine. So the issue is decided on the very first connection of the new user, if it is WiFi or wire.

I checked dot1x in ssid and it is off (default), but actually the tests I made were on an already registered host, and here it is clear that the issue is not in the host registration but in the user registration. And I confirm the user information populated in the "Logged On" attribute.

Know that the PA is installed on the PC, and the PA should tell FNAC that the AD user is logged in right, and I suppose it does already, but since this is a new user, I guess FNAC couldn’t create it as “Loaded from Directory” since the same “user id” has been created by RADIUS authentication not as “Loaded from Directory”, I guess FNAC just didn’t allow itself to overwrite it, right? And once I delete the user, FNAC creates it few minutes later as “Loaded from Directory”. That’s what I want to do automatically if possible.
Regarding domain & user format in RADIUS authentication, I just used the correct AD username and it worked, I didn’t specify the domain with the username. For info I’m using RADIUS proxy, and I want to avoid local RADIUS/Winbind.
I’ll try run the provided command and will share the output.
Thanks again, Emirjon.