FortiAuthenticator Create multiple realm "host" to authenticate computer using EAP-TLS

[AsHub]

Hello, 

We are using FortiAuthentiticator to configure 802.1x EAP-TLS with computer authentication, we have to create two realms "host" as we have two domaines but FortiAuthenticator does not accept to create two realm with the same name. 

is there any workaround?

[adambomb1219]

Use a different name.  Why do you have multiple domains?  Is there not a trust relationship?  FortiAuthenticator is not designed for multi-tenancy.

[AsHub]

I have to name the realm "host" for the computer authentication to work, it's our customer's environnement. 

[Debbie_FTNT]

Hey AsHub,

the configuration guide that I assume you're using (https://docs.fortinet.com/document/fortiauthenticator/6.5.0/cookbook/773402/computer-authentication) does indeed suggest the realm name 'host' as an example, but this is not a requirement. The realm name is only important if you have multiple realms in the same RADIUS policy on FortiAuthenticator and need to distinguish between them, AND you want the realm name stripped from the username.

As an example:

- two realms, 'ad' and 'ad2' in the same RADIUS policy
- user format set to 'user@realm' in RADIUS policy
- if a user logs in as 'user@ad' authentication will go to realm 'ad', and only 'user' will be authenticated
- if a user logs in as 'user@ad2', authentication will go to realm 'ad2', and only 'user' will be authenticated

- if a user logs in in any other way ('user', 'user@ad3', 'ad\user', 'ad2/user') then the entire string will be treated as username and sent to the default realm in that RADIUS policy.

Based on the cookbook article I referenced above, the realm-name is irrelevant: The example policy is configured with username format 'user@realm', but no machine account will have a name like 'computer$@host' or similar, and realm could be called 'xyz' or some other nonsense just as much.

If my assumption (as to the cookbook article and WHY the realm(s) should be named 'host) is incorrect, can you please clarify WHY the realms have to be called 'host'? FortiAuthenticator does not allow realms with the same name due to the realm-matching I described above; it would break if you could put two realms with the same name in the same RADIUS policy, so duplicate names are not allowed.

Cheers,

Debbie

[AsHub]

Hello Debbie_FTNT, 

The realm should be named "host" because windows machines send "host/fqdn" to authenticate computers. if you don't name your realm "host" the FortiAuthenticator does not recognize the user.

[Toshi_Esumi]

If two customers/orgs using the same domain name, one FortiAutenticator(FAC) wouldn't separate them. You can try persuading one or them to change their domain name, or you need to have two FACs.

Toshi

[AEK]

In such scenario creating a realm named "host" was documented as such by @Sx11 

https://community.fortinet.com/t5/FortiAuthenticator/Technical-Tip-FortiAuthenticator-802-1x-EAP-TLS...

I guess he can help.

[AEK]

After some research I found that this problem is known for machine based authentication (with machine certificate) for pre-user-authentication connection, where Windows domain uses the "host/" prefix in that case and it seems there is no way to change that.

This is usually resolved by switching to user based authentication with user certificate.

Again @Sx11 who wrote the tech tip may know further about that.