RSSO in 6.2.3 doesn't define "user group" in policy

Question

Hello everyone,We have FG300 with FortiOS 6.2.3 and Freeradius. Use RSSO to authorize WIFI users. The user falls into the group on FG, but it is not defined in the policy and, accordingly, the policy does not work. We need help, which may be the reason. FortiGate # dia test app radiusd 3 RADIUS server database [vd root]: "index","time left","ip","endpoint","block status","log status","profile group","ref count","use default profile" 1,07:58:42,"192.168.51.10""host/ARM0796.lokb.spb.ru","allow","no log","<default profile>",1,Yes 2,07:59:57,"192.168.57.4""ushakov","allow","no log","usersLOKB",1,No FortiGate # sh user radius RSSO\ Agent config user radius  edit "RSSO Agent"  set rsso enable  set rsso-radius-response enable  set rsso-validate-request-secret enable  set rsso-secret "secret"  set rsso-endpoint-attribute User-Name  set rsso-flush-ip-session enable  set rsso-ep-one-ip-only enable  next end FortiGate # sh user group RADIUS\ users config user group  edit "RADIUS users"  set group-type rsso  set sso-attribute-value "usersLOKB"  next end  Received radius accounting eventvd 0:root Add/Update auth logon for IP 192.168.57.4 for user ushakov DB 0 insert [ep='ushakov' pg='usersLOKB' ip='192.168.57.4/32'] success User is visible in Monitor > Firewall User Monitor as the rsso user, but policy doesn't work

mschoenberger · Accepted Answer

I have figured it out.

You have to set rsso enable in the CLI for the policy before it would work as follows:

CaveCreekUnified-SNA~T01 $ config firewall policy CaveCreekUnified-SNA~T01 (policy) $ edit <policyID> CaveCreekUnified-SNA~T01 (52) $ set rsso enable CaveCreekUnified-SNA~T01 (52) $ end

mschoenberger · Answer

I am having the same issue. Users get assigned to the appropriate groups, but when I add the RSSO Group to a policy, it does not work.

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded