| Solution |
The IAM user logs into a Fortinet Cloud Service and gets error A01I08-17 'Unauthorized. You are not currently authorized to access this portal. Select a different portal or log out, as shown in the screenshot below:
This is a permission issue, where the IAM user lacks permission to access the Portal.
Note that the default built-in permission profile 'SysAdmin' only provides access to Asset Management and IAM.
Another symptom of the same issue is the absence of Fortinet Cloud service icons for Services with active subscriptions, in the Services menu on the FortiCloud home page, after the IAM user has logged in
Follow the steps below to ensure that the IAM user has permission for the Fortinet Cloud Services.
- Log in to the support portal with the Master account.
- Navigate to Services -> IAM.
- Navigate to the Permission profile, then select ‘Add New’.
- Provide a name to the profile and select 'Add Portal'.
- Check FortiGate Cloud, then select Add:
If the organization has a valid FortiGate Cloud subscription or selects any of them with a valid Subscription, it is also possible to create different profiles, permitting each one access to a group of Services and associating them with different IAM users to limit the access of each one.
- Change the permissions to 'Read' or 'Read & Write' as needed, then select 'Submit'.
- Navigate to Users, then select the user.
- Select 'User Permissions', and then 'Edit'.
- Under the permission profile, select the newly created permission profile and select 'Update'.
The IAM user will now be able to log in to the FortiGate Cloud portal.
Important notes:
- The IAM user can also be used to log in to the FortiGate using single sign-on. To enable this feature, follow this guide: FortiCloud SSO.
- Also exists a third type of FortiCloud Users, the Subuser. This is a legacy type of users, as explained here: User Management Models is useful to migrate them to IAM users, as explained here: Migrating Sub Users, for example, to avoid confusion in case of Subusers and IAM Users associated with the same email.
- Referring to the Migration Sub Users guide, it is necessary to pay attention to the second option at point 3. If that option is used, the new IAM Username will be what is before the “@” of the Subuser email.
- To access as an IAM user is necessary to know the ID of the Email User Admin of the organization, putting it in the first field of the IAM login section.
|
