| Description |
This article describes the limitations of tenant restrictions enforced on custom applications under inline-casb. |
| Scope |
FortiGate v 7.6.3 or above.
Tenant restriction enforced on custom application via inline-casb security profile.
Consider the scenario where it is required to restrict the use of personal email login attempts on a particular site(s), but only allow corporate emails.
For illustration, only permit the '@fortinet.com' domain on https://github.com/login; prevent login to the other domains on the same site.
Regardless of the above configuration, end users will still be able to log in to github.com using their personal account, which is not expected.
|
|
Solution |
At the time this article was written, inline CASB custom-app tenant filtration is limited to sites using the application/json format as their content type.
Since github.com/login is of application/x-www-form-urlencoded format, tenant checks are bypassed. This can be verified under inline-casb security event & WAD debug log
Inline CASB security event log:
date=2025-09-17 time=18:34:31 eventtime=1758105271778521246 tz="+0800" logid="2500010002" type="utm" subtype="casb" eventtype="casb" level="information" vd="root" policyid=1 poluuid="90194c30-9237-51f0-6c1e-a6253a277323" policytype="policy" sessionid=751232 srcip=10.72.5.128 dstip=20.205.243.166 srcport=60310 dstport=443 srcintf="port3" srcintfrole="undefined" srcuuid="750b364a-8735-51f0-aabf-8d9c37995b4e" dstintf="port2" dstintfrole="undefined" dstuuid="750b364a-8735-51f0-aabf-8d9c37995b4e" proto=6 url="https://github.com/session" action="monitor" profile="testgit" saasapp="github-ftnt" useractivity="github-ftnt-GitHub-Login-Policy" subaction="monitor" tenantmatch="missed" activitycategory="other" msg="CASB access was monitored because it contained activity.
WAD debug log:
diagnose wad debug enable category casb diagnose wad debug enable level verbose diagnose deb enable
[I]2025-09-17 19:10:34.999512 [p:23995][s:770654][r:395] wad_casb_prof_ua_proc :1785 app:0x7f4ddd5d5ed8/github-ftnt, ua:0x7f4ddd582940/github-ftnt-GitHub-Login-Policy match:ua-init, tc:ua-init, msg:0x7f4ddd8d8228/req body:(nil)
Notes:
|
