A user group is a list of users.
Security policies and some VPN configurations only allow access to specified user groups.
This restricted access enforces role-based access control (RBAC) to your organization's network and resources.
Users must be in a group and that group must be part of the security policy.
In most cases, FortiOS authenticates a user by requesting their username and password.
FortiOS checks local user accounts first.
Then, if it does not find a match, FortiOS checks the RADIUS, LDAP, and TACACS+ servers that belong to the user group.
Authentication succeeds when FortiOS finds a matching username and password.
If the user belongs to multiple groups on a server, FortiOS matches those groups as well.
FortiOS does not allow username overlap between RADIUS, LDAP, and TACACS+ servers.