This article describes how to debug and identify missing configurations when Customers have configured Google Authentication accounts to onboard new devices via the FortiNAC Captive Portal using Google credentials.
FortiNAC.
This configuration allows users to onboard their devices through the FortiNAC portal by leveraging their Google Credentials.
Important: The FortiNAC Portal should be secured with a Valid SSL certificate in order for Google Services to accept the Request. The certificate used to secure the portal should have as its subject the FortiNAC FQDN which should be also specified in Portal -> Portal SSL.
If this is not the case the users will be presented with an error 400 or other Incorrect Request Error Codes:
After successful authentication, the user will see a message: 'Logged in as: <Username>' and be prompted to select 'Agree' in order to accept the acceptable usage policy.
In some cases, it is possible to have an error message from the browser after selecting 'Agree': 'Login Failed: Authentication Failure'.
In most cases, this is related to a missing domain in the Google Service Connector Domain list and in Allowed Domains in FortiNAC.
To identify what is causing the issue it is necessary to tail the output.master file as follows in FNAC-F CLI:
diagnose tail -F output.master
It will display the following debug output in CLI after the issue is recreated:
yams INFO :: 2023-10-10 14:14:11:658 :: #541 :: DeviceManager:authenticationSocialSMA - start :
yams INFO :: 2023-10-10 14:14:11:658 :: #541 :: provider : google
yams INFO :: 2023-10-10 14:14:11:658 :: #541 :: accessToken : XXXXXXXXXXXXX
yams INFO :: 2023-10-10 14:14:11:658 :: #541 :: regMethod : GOOGLE
yams INFO :: 2023-10-10 14:14:11:658 :: #541 :: scope : registration
yams INFO :: 2023-10-10 14:14:11:658 :: #541 :: ip : 192.168.10.1
yams INFO :: 2023-10-10 14:14:11:972 :: #541 :: authenticateSocialSMA: the domain for this user (fortiUser) is not in the allowed list : fortilab.local
yams INFO :: 2023-10-10 14:14:11:977 :: #541 ::
Registration FAILED Authentication Failure fortiUser
In order to resolve this, it is necessary to add the domain 'fortilab.local' to the following sections:
Finally, the user is authenticated and registered by being associated with the host.
Access can then be controlled by Network Access policies.
Implementation:
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.