Yes, it supports radius authentication to MS-svr NPS, using Fortigate wifi as controller on 5.6.4
i have done it before. , setting up Dynamic vlan too. U will only see one SSID being broadcast, but the vlan assignment will be done by the NPS server.
config wireless-controller vap
edit "wifiVLAN 20"
set vdom "root"
set ssid "Wifi VL 20"
set security wpa2-only-enterprise
set auth radius
set radius-server "nps"
set local-bridging enable
set schedule "always"
set dynamic-vlan enable
set alias vlan20"
next
config user radius
edit "RSSO Agent"
set rsso enable
set rsso-radius-response enable
set rsso-validate-request-secret enable
set rsso-secret ENC E9cLZfDJ+NyCHq7IvmcOb3Q1m6euYfq2CXoENBpcdYVG5G27NW8oFBSr4wFS0/DFlb7ZtlC7QrllvbCMKCbgEH/cOP/D3fS7CO8rtys6nb9ppLdoS7S4T7tgWFVZhe9+SQE6puM/Q75Frc48FRlgGV4mgYA3fX5uBS9D7zr4VTf3zsVQ0r+XSlu8ujeklpz1PVwKCg==
set rsso-endpoint-attribute User-Name
set rsso-context-timeout 0
set rsso-flush-ip-session enable
next
edit "NPS"
set server "192.168.2.200"
set secret ENC lhVTxUfCx+hCufi1DUq8tMKSykHrkjDZXdAPf5XbM7ROdKtE7YI0g7Q+HLe8Nc86IaBDrtSX9qGX5q4gSZWP81VQpsrvtC6GhdHD3Ql6N3tzfF+GCQ2CvPwL9rbiS3nXp+qOm99DdH5x6eSJANHLtKPPk+H2Dm8AmjXgrl/NPPxmnCc0c7+RiYrJ/NuOtSEhvr/xnw==
set auth-type ms_chap_v2
config accounting-server
edit 1
set status enable
set server "192.168.2.200"
set secret ENC N6LJ9Fk+OV17pWRsJtK4QU/UyaSzbUyBGPuOA/p6VREY3jrV0BHiSrcRrnxUPbwCPfLQLM+0LPve9MLuYmz5+PHz5Qq1NylKr/hTZ36M5Mdrl+gnJBrw7+Kqr5PvpRcKZxPJYR0GHSvNzM3lXoBBkJ0j15A9Mk/IZLjx1dXni/GHN2xpLj4GoapjVyLaa/cbyTMS0w==
next
end
next
end
