Skip to main content
AEK
SuperUser
AEK
SuperUser
November 10, 2024
Question

FWB HTTP authentication via RADIUS with FAC

  • November 10, 2024
  • 2 replies
  • 1981 views

Hello

FortiWeb 6.3.9 and FortiAuthenticator 6.4.9.

My FWB is configured to authenticate admins (for admin access) via RADIUS authentication with FAC and it works just fine.

This issue comes when I want to use HTTP authentication, for users when they want to access some protected Web servers.

I configured like explained here:

https://docs.fortinet.com/index.php/document/fortiweb/6.3.9/administration-guide/467409

Now when a user tries to access a protected server, it shows HTTP authentication window, but when user enters correct username and password, FWB still returns error 401 (unauthorized), even if my FAC logs show the related authentication was successful.

For info on FWB's RADIUS config, when I test the authentication with the same credentials it works fine.

2 replies

holinbo1
holinbo1
New Member
November 10, 2024

RADIUS is still the method to connect authentication of networking devices to your domain. Move to WPA2-enterprise and have users login with domain creds. They instantly lose connectivity if their credentials are disabled / locked https://mobdro.bio/ .

AEK
SuperUser
AEKAuthor
SuperUser
November 11, 2024

This response is off topic.

AEK
kwcheng__FTNT
Staff
kwcheng__FTNT
Staff
November 11, 2024

When FortiWeb repeats HTTP 401, it simply means the authentication failed. Since you had confirmed that the authentication passed in the Fortiauthenticator, perhaps it is caused by timeout setting if it took more than 2 seconds for the FAC to response back.

 

You can check the explanations here:

a) Error 401:

https://help.fortinet.com/fweb/583/Content/FortiWeb/fortiweb-admin/offloading_http.htm

b) timeout issue:

https://docs.fortinet.com/index.php/document/fortiweb/6.3.9/administration-guide/467409

 

Regards

Patrick

AEK
SuperUser
AEKAuthor
SuperUser
November 12, 2024

Thanks for your response, Patrick.

Yes I confirm the authentication is successful. I also confirm there is no timeout because I enabled debug logs on FWB and the event logs show that the authentication is reported successful on FWB as well.

Any other idea?

AEK
kwcheng__FTNT
Staff
kwcheng__FTNT
Staff
November 12, 2024

As said, receiving 401 errors simply indicating the FWB still unable to authenticate the users successfully. Whether the FWB is waiting for a specific response from FAC or the received packet is not identifiable, you might want to initiate a TAC ticket to verify.

 

Regards

Patrick

Terms & ConditionsAccessibility statement