Remote admin SSH + RADIUS/FAC: authentication triggered only for accprofile super_admin

I’m trying to configure remote administrator access via SSH on a FortiGate using RADIUS (FortiAuthenticator), where the admin privileges on the FortiGate depend on the user’s Fortinet VSA (e.g. Attribute: Fortinet-Group-Name, value: ADMIN_FORTIGATE) and corresponding remote-group mapping.

Goal: allow different remote admins to log in via SSH with different admin access profiles, for example a read-only admin using the built-in super_admin_readonly (or a custom read-only accprofile).

I noticed that:

• If the admin entry is configured with set accprofile "super_admin", SSH login works and the FortiGate does send RADIUS Access-Request to FAC.
• If the same admin is configured with any other accprofile , SSH login fails with a generic Failed password, and no RADIUS traffic is generated at all.

So, it looks like remote admin authentication via SSH is only triggered when the admin has accprofile = super_admin, while non-super_admin profiles do not even reach RADIUS.

So, my questions are:

1. Is it expected that remote admin SSH + RADIUS works only with accprofile super_admin?
2. If not, is there a known setting/feature/bug that would cause RADIUS not to be invoked for remote admins with super_admin_readonly (or custom profiles)?

Environment:

• FortiGate-VM (KVM/QEMU lab)
• FortiOS versions tested: 7.6.x and 7.2.x (same behavior)
• RADIUS server: FortiAuthenticator
• remote-auth enable on admins and remote-group configured