Troubleshooting Tip: Incorrect Remote RADIUS User Authenticated as a Local User Group Member

[anderson_yee]

Description	This article describes the solution when a remote RADIUS user is incorrectly authenticated as a local user group member.
Scope	FortiOS, RADIUS authentication.
Solution	For example, two user groups (LOCAL and RADIUS) are configured on FortiGate as below: LOCAL user group has a local user: 'local1'. RADIUS user group has a remote RADIUS user: 'radius'. The issue happens when the RADIUS user ('radius') is incorrectly authenticated as the 'LOCAL' user group member even though it is not configured as one of the members. This issue is related to 'set all-usergroup' settings being enabled under RADIUS server configuration on FortiGate. Enabling this feature will automatically include this RADIUS server in ALL user groups (including local user groups). Disabling this feature will resolve this issue and prevent RADIUS users from being incorrectly authenticated as a local user group member. User 'radius' should only be authenticated as a 'RADIUS' group member and not as a 'LOCAL' group member after disabling the feature.