Tacacs configuration - Authentication OK but no access to vdom
Hello,
I'm actually having an issue when configuration Tacacs+. Authentication is working correctly but I don't have access to vdoms. I'm running on FortiOS v5.4.5,build1138 (GA).
Configuration :
config vdom
edit elbc-mgmt
config user tacacs+
edit "TACACS-ISE"
set server "x.x.x.x"
set key ENC zqwEyuAFNC55u3Ve4ryjqLYTZTF91Wva825q4IkLKYKoIGUZ3l11QyuAOukWRP8Ejn11hODEqj/+yox3kD20pt0JWuhMSC7U/EVRSiwb9o6Dwx9SRlGhoXSPmHtQ15iN+8kGdn6FLsqzxpOAsXqJY79sqR6DsoPVsjxBx19ceUpJjary0oApEngL80aZeFIdluwA==
set authorization enable
next
end
config user group
edit "TACACS_Group"
set member "TACACS-ISE"
next
end
config global
config system admin
edit "TACACS_User"
set remote-auth enable
set accprofile "noaccess"
set comments ''
set vdom "elbc-mgmt"
set schedule ''
set two-factor disable
set email-to ''
set sms-server fortiguard
set sms-phone ''
set guest-auth disable
set wildcard enable
set remote-group "TACACS_Group"
set accprofile-override enable
set radius-vdom-override disable
next
config system accprofile
edit "noaccess"
next
edit "Read_Write"
set mntgrp read-write
set admingrp read-write
set updategrp read-write
set authgrp read-write
set sysgrp read-write
set netgrp read-write
set loggrp read-write
set routegrp read-write
set fwgrp read-write
set vpngrp read-write
set utmgrp read-write
set wanoptgrp read-write
set endpoint-control-grp read-write
set wifi read-write
next
edit "Read_Only"
set mntgrp read
set admingrp read
set updategrp read
set authgrp read
set sysgrp read
set netgrp read
set loggrp read
set routegrp read
set fwgrp read
set vpngrp read
set utmgrp read
set wanoptgrp read
set endpoint-control-grp read
set wifi read
next
end
Below admin status command :
FortiGate $ get system admin status username: user login local: ssh login device: base-mgmt:10.101.10.4:22 login remote: 10.101.10.15:64576 login vdom: elbc-mgmt login access profile: Read_Write login started: 2017-10-02 13:57:02 current time: 2017-10-02 13:57:15
Does anyone encounter this issue? User need to have access to all vdoms but it seems in my case he only have access to 1 vdom.
Thank you for your help
Eric