Technical Tip: How to use TACACS+ attribute for admin authorization when accessing FortiWeb

[faical]

Description	The article explains how to configure FortiWeb to use TACACS+ attribute for authorization (FortiAuthenticator as TACACS+ server).
Scope	FortiWeb.
Solution	FortiAuthenticator should already be configured as a TACACS+ server with a local user and the authorization rule. Then, a service to be added to the rule using the attribute value pair: admin_prof=read-only (FortiWeb only supports the attribute admin_prof): The rest of the configuration should be as follows (TACACS is the local username on FortiAuthenticator):   An Administrator 'Tacacs_user' (as an example) to be added on FortiWeb, pointing to FortiAuthenticator IP: A profile name to be created on FortiWeb, 'read-only' matching exactly the attribute value created on FortiAuthenticator above. This profile can be customized as per need :   Access profile override to be enabled on CLI: FortiWeb# config system admin FortiWeb (admin) # edit Tacas_user FortiWeb (Tacas_user) # set accprofile-override enable FortiWeb  (Tacas_user) # end After the authentication of TACACS+ user (for example via FortiWeb CLI), no configuration is allowed as it is set read-only: FortiWeb $ config <Enter> Related document: Offloading HTTP authentication and authorization