802.1x authentication failed: user not found

[eshaq786]

Hi

I am getting an issue when trying to authenticate a device using radius. I have exported the certificate for a user but according to logs they do not exist or cannot be found.

802.1x authentication failed: user not found

It seems to work perfectly for users synced across AD.

What am I missing?

[Carl_Windsor_FTNT]

You don't give enough detail such as where the failing user is stored (local DB?) and if they can authenticate without 802.1x e.g. directly via RADIUS auth.  Without more details, I would start to debug as follows:

[ul]

Use a tool like NTRADPing to test RADIUS Auth

If this fails also, check that you have your realms correctly configured for the auth client you are authing from[/ul]

Also going to https://<FAC_IP>/debug/radius/ to look at the extended logs (enable "Enter Debug Mode" for verbose logging but remember to disable after use).

[eshaq786]

The failed user is a local user stored locally on the fortiauthenticator itself. 

We have a remote sync rule to sync across users from AD and these seem to work without a problem. I wouldve though a user created locally would work far more easily.

The realm is setup for local users. The realm is also added to the radius clients but not as default. It is added as the second option.

I've gone into the logs but cannot see an option for enter debug mode.

[Carl_Windsor_FTNT]

>I've gone into the logs but cannot see an option for enter debug mode.

Sounds like you may be running an old build.  Which version are you running?

[eshaq786]

v3.00-build0060-20140612-patch00

[Carl_Windsor_FTNT]

This is a very old release (16 months) and there have been a large number of developments and fixes in this area.  I would recommend upgrading to a later release (4.0) and retrying.  

*Backup your config first of course.

FAC 4.1 is imminent (next few days) so you may want to hold fire for this release.

Carl

[eshaq786]

The below is the log output. It appears to be trying to search through ldap. If i create an account on AD for ipadtest it seems to work. How do i get it to search local accounts? The realm under the client section in the radius section seems to have the "Allow local users to override remote users" tick box greyed out for local realm. There is an LDAP realm but that has the groups filtered to exclude this user group.

===>Username:ipadtest 2016-04-08T14:34:54+01:00 FortiAuthenticator radiusd[21665]: ===>NAS IP:172.18.3.1 2016-04-08T14:34:54+01:00 FortiAuthenticator radiusd[21665]: Realm: (null) (default realm id: 3) username: ipadtest 2016-04-08T14:34:54+01:00 FortiAuthenticator radiusd[21665]: Realm not specified, default goes to remote LDAP, id: 1 2016-04-08T14:34:54+01:00 FortiAuthenticator radiusd[21665]: Loaded remote ldap (regular bind) 172.16.100.25:389 2016-04-08T14:34:54+01:00 FortiAuthenticator radiusd[21665]: Try to search user by: (&(objectClass=person)(sAMAccountName=ipadtest)) 2016-04-08T14:34:54+01:00 FortiAuthenticator radiusd[21665]: ERROR: fac_ldap_search() failed: number of entries: 0 2016-04-08T14:34:54+01:00 FortiAuthenticator radiusd[21665]: # Executing group from file /usr/etc/raddb/sites-enabled/default 2016-04-08T14:34:54+01:00 FortiAuthenticator radiusd[21665]: Updated auth log 'tipadtest': 802.1x authentication failed: user not found 2016-04-08T14:34:54+01:00 FortiAuthenticator radiusd[21665]: Waking up in 0.9 seconds. 2016-04-08T14:34:55+01:00 FortiAuthenticator radiusd[21665]: Waking up in 4.9 seconds. 2016-04-08T14:35:00+01:00 FortiAuthenticator radiusd[21665]: Ready to process requests. 2016-04-08T14:35:06+01:00 FortiAuthenticator radiusd[21665]: # Executing section authorize from file /usr/etc/raddb/sites-enabled/default

[Carl_Windsor_FTNT]

Did you set Realm: Local | Local Users in the RADIUS Client Config (Authentication > RADIUS Service > Clients)?

[eshaq786]

Yes thats set.