Skip to main content
AliE
AliE
New Member
April 1, 2022
Solved

How to automate Token attribution of users? How to automate mails attribution of users in fortigate.

  • April 1, 2022
  • 1 reply
  • 1760 views

Hi all,
Since few days, we have started to use FortiToken and 2FA with the Fortigate's solution. Firstly, we have users in our AD, but we couldn't add mails associate in each user automatically. For that, you have to add mails manually for each user. You have any ideas about that?

In addition, we can't automate the distribution of token for users? Because with a hundred users, it's not normal to attribute tokens manually.
Any help would be appreciated.
Thanks,

Ali

Best answer by Markus_M

Hello,

 

with the FortiGate you cannot automate this. The FortiAuthenticator is suited better for this than the firewall. FortiGate can communicate to FortiAuthenticator via RADIUS and the FortiAuthenticator can automatically synchronize users from an LDAP server and assign them tokens, put them to specific groups etc.

 

Example is here:

https://docs.fortinet.com/document/fortiauthenticator/6.1.2/administration-guide/215969/remote-user-sync-rules

 

On the FortiGate you may be only able to add the tokens via some externally written SSH script that would add a user and a token from the pool. Not impossible but it would be challenging.

 

Your script should have a database of the available tokens and maintain it, i.e. remove a token when it gets assigned, remove a token when a user disappears.

 

Best regards,

 

Markus

1 reply

Markus_M
Staff & Editor
Markus_MAnswer
Staff & Editor
April 2, 2022

Hello,

 

with the FortiGate you cannot automate this. The FortiAuthenticator is suited better for this than the firewall. FortiGate can communicate to FortiAuthenticator via RADIUS and the FortiAuthenticator can automatically synchronize users from an LDAP server and assign them tokens, put them to specific groups etc.

 

Example is here:

https://docs.fortinet.com/document/fortiauthenticator/6.1.2/administration-guide/215969/remote-user-sync-rules

 

On the FortiGate you may be only able to add the tokens via some externally written SSH script that would add a user and a token from the pool. Not impossible but it would be challenging.

 

Your script should have a database of the available tokens and maintain it, i.e. remove a token when it gets assigned, remove a token when a user disappears.

 

Best regards,

 

Markus

    Terms & ConditionsAccessibility statement