| Description | This article describes how to assign Roles based on Directory attributes. |
| Scope | FortiNAC-F, FortiNAC. |
| Solution |
When assigning user roles, it is recommended to perform the role assignment based on the Directory attributes of the user in LDAP instead of Directory group membership. The reason for this is due to FortiNAC looking for the directory attribute data during the registration process of the user, while group information could not be accurate since the next Directory synchronization might have not been executed yet to update the FortiNAC cache with the new group information.
As an example, user 'jdoe' has an attribute 'departmentNumber' = 567851 This can be verified in Active Directory Users and Computers -> Select 'jdoe' or any other user -> Select 'Attribute Editor'.
 Figure 1. Use "departmentNumber" attribute for Role based access in FortiNAC.
In FortiNAC, add the 'departmentNumber' as an attribute to look for when applying for the user role. In this case, FortiNAC will assign as Role the value given to the attribute which is 567851. Go to System -> Settings -> Authentication -> LDAP -> Modify -> User attributes and set the Role entry as departmentNumber.
 Figure 2. Using a Directory attribute as Role entry in FortiNAC LDAP configuration..
Each user will then be assigned a Role based on the Department number they are part of. Go to Policy & Objects -> Roles and create a Role matching the Department number.
 Figure 3. Creating the Role matching the departmentNumber attributes.
At this point, it is possible to test Role assignment by having the user authenticating via 802.1x.
Create a 'User/Host Profile' or edit an existing one and select User -> Role and then select the recently created Role from the drop-down list in 'Who/What' attributes.
The following debug can be enabled in FortiNAC CLI to verify role assignment:
naclab1 # diagnose debug plugin enable DirectoryAuthentication
yams.DirectoryManager FINER :: 2024-09-19 10:55:35:126 :: #6015 :: DirectoryManager::getDirectoryUser jdoe
In FortiNAC GUI, it is possible to verify the new role assignment on both the User and the inheritance of the role from the Host where the user is logged in. Figure 4 and Figure 5 show both cases.
 Figure 4. User Role assignment verification in FortiNAC User accounts
 Figure 5. Host Role inheritance Verification in FortiNAC Host view.
This method can be also used in conjunction with the assignment of the 'Security&Access' attribute for more granularity in matching host records when applying Network Access policies. For details of this configuration, see Technical Tip: Leverage the 'Security & Access Value' attribute as additional criteria for policy ma....
Related documents: |
