[Help] FSSO Authenticated with User Domain

Hi NothingKai,

if I got your situation correctly then .. - you have working FSSO, user's logon to workstation is spotted and propagated to FortiGate, and when user browse the protected resources (Internet access probably), then is seen by FSSO user group in policy, policy applied and passive authentication is done and traffic allowed without any active auth request (pop-up for auth on user's browser).

- then you have non-domain users which you'd like to authenticate. But for this I do not have any idea where you can authenticate those. For simplicity you can use local FortiGate users or Guest Management on FortiGate for visitors. For those make a firewall group similar to step 4. in following guide. Then make firewall policy for this group as in step 5. but make sure it's placed bellow your FSSO policy. FortiOS 5.2 and 5.4 has implicit fall through for unauthenticated users, so next user identity policy will be tried. Pay attention to fact that if there is any non-identity (pure IP based) policy handling the same traffic pattern (src/dst/ports) then it will be tried and used first. So if it blocks/allow traffic then there will be no identity check at all.

Guide I was referring to is here : http://cookbook.fortinet.com/providing-single-sign-using-ldap-fsso-agent-advanced-mode-expert/

Best regards, Tomas