EMS Authentication Server with multiple domains

[aguerriero]

When adding an authentication server in EMS I only ever get 1 domain even when the tenant has multiple domains registered and synced. These aren't subdomains but two different unique domains.

example1.com
example2.com

The only information I provide is the tenant ID, client ID, and secret. And then I only get 1 domain available for doing user to OU matching to assign policies.

How do I get all of the available domains that are synced in azure so I can can assign policies? Currently I have to create workgroups and assign the users to that either manually or with group assignment rules.

[pminarik]

I see, thanks for clarifying.

Unless someone comes in and corrects me, this feels like a scenarion that we may not have accounted for, and may need an NFR or a "bug fix", depending on how it ends up being classified. I would recommend opening a TAC ticket to get attention on this.

[aguerriero]

This seems to be working, kind of, after upgrading from 7.2.1 to 7.2.3. I don't know if anything else doesn't work after the upgrade but users from both UPNs can now verify.

[sw2090]

Sorry I have no experience with EMS yet as we do not yet use it.

[Jean-Philippe_P]

Thanks guys for answering so quickly :)

[Anil_Solakoglu · Accepted solution]

Hello,

In the earlier stages of 7.2.x we used to provide a workaround like described below.

https://community.fortinet.com/t5/FortiClient/Technical-Tip-Transforming-users-attributes-while-veri...

This behavior changed after 7.2.3 due to a resolved issue over bug 953051.

Starting from version EMS 7.2.3 supports UPNs with different domain names rather than the imported one, as long as the SAML attributes contain the right user UPN.

https://docs.fortinet.com/document/forticlient/7.2.3/windows-release-notes/22791/resolved-issues