Technical Tip: Guide to configure RADIUS Login to FortiPAM with OTP on Radius-Server

[ocara]

Description	This article describes the steps required to configure RADIUS authentication on FortiPAM for users located on a remote RADIUS server, such as FortiAuthenticator, with OTP management handled by FortiAuthenticator as well.
Scope	FortiPAM.
Solution	Prerequisite: A RADIUS server must be preconfigured. In this scenario, FortiAuthenticator is used. A user named 'pamadmin is also configured on the RADIUS server, with a specified token assigned to the user. On FortiAuthenticator, a RADIUS client entry is created for FortiPAM, and the corresponding RADIUS policy is preconfigured. Steps to be followed on FortiPAM: Configure RADIUS Server on FortiPAM. Authentication Type can be selected between PAP, CHAP, MSCHAP, and MSCHAPv2. Predefine IP and Secret for Radius-Server. FortiPAM provides the option to configure a secondary RADIUS server through the GUI, while a tertiary entry can be configured using the CLI. Proceed with the next steps and test the connection. The status should display as 'Successful'. A user test can be performed from the CLI, similar to the process on a FortiGate firewall. FPAVULTM23000759 $ diagnose test authserver radius FortiAuthenticator pap pamadmin ******** Token Code:****** authenticate 'pamadmin' against 'pap' succeeded, server=primary assigned_rad_session_id=555788133 session_timeout=0 secs idle_timeout=0 secs! Group membership(s) - pamrad Make sure to configure the Auth-Schema as below: config authentication schema #(scheme)$ edit fortipam_auth_scheme #(fortipam_auth_scheme) $ set user-database local-admin-db FortiAuthenticato Configure the user in the user database and map it to the RADIUS server. Navigate to User Management and select Create. Note: Unlike the FortiGate firewall, FortiPAM does not support wildcard administrator accounts. The account used for RADIUS authentication must have the same username as it is on the RADIUS server.   Select the role of Administrator user, which can be either the Default Administrator or the Super Administrator. Select Remote User and then select the RADIUS Server itself, or map a RADIUS User-Group directly to the same RADIUS Server, which should be preconfigured under User Management -> User Groups. Ensure that the Username is the same as the name on the RADIUS Server. Leave all other steps as default without making any changes. Test Login: Go under Monitoring -> User - Monitor. If authentication fails, additional debug logs can be checked from the FortiAuthenticator side at https://<FAC-IP>/debug by selecting RADIUS Authentication. FortiPAM debugs: diagnose debug console timestamp enable diagnose debug application fnbamd -1 diagnose debug enable Related documents: RADIUS servers  Creating a user