How to assign multiple mobile fortitoken to Radius users(20K users)in fortiauthenticator

[dabens]

Hi all,

how can I assign my 20k radius users to fortitoken? I need to assign them one by one on GUI?

Thanks

[xsilver_FTNT]

Hi dabens,

it depends on where are your users coming from.

Easier way would be LDAP sync, if you do have those users in AD or in another LDAP structure, then:

FortiAuthenticator (FAC hereinafter) > GUI: Authentication > User Management > Remote User Sync Rules > {Edit/Create RULE} > Synchronization Attributes > Token-based authentication sync priorities: ...

.. and here choose what tokens you would like to assign to those who will fit an LDAP filter and so get automatically synced from your AD/LDAP to your FAC.

Note that:

- HW tokens need to be active/available on unit, and also you can specify SN of the assigned token in LDAP string attribute of your choice (name of attribute have to be in "FTK-200 serial number:" bellow), and then this specific token will be always (if available) assigned to the synced user. Another option is to have all the HW tokens in pool and just assign random one. But it is IMHO more convenient to set specif attribute in AD to the SN of the token you just handed over to user, and throught the mentioned setup be sure that this token will be assigned to user in FAC. All driven from AD, no need to touch FAC, except the initial setup of sync rule.

- for Mobile tokens FAc has to have valid license for those and so be able to assign those. Tokens are assigned from pool and as tokens are not handed over but activated on mobile device via received code, then their SNs do not need to be known in advance. Keep in mind that appropriate activation code delivery method has to be available/set (SMS/Email GW) and that users have to have proper email/mobile number set and synced (usual caveat)!

- similar for Cloud tokens, where your FAC has to be registered under same FortiCare account which do have FortiToken Cloud license and points available

- token will be assigned only if there is token of specified type (and SN if set for HW ones) available in pool

- if user is deleted, manually or due to the fact he is no more matching LDAP filter, then token assigned to him will be released back to pool of free/available tokens

Unfortunately you were not that specific about your tokens (and Fortinet produce at least 5 different models compatible with FAC) and source of your users. But I guess that 20k users are not on paper, but in some manageable structure like AD, right?

Hope this helped a bit.

[dabens]

Hi xsilver,

thank you for your post. 

Yes, users are in AD structure.

"if user is deleted, manually or due to the fact he is no more matching LDAP filter, then token assigned to him will be released back to pool of free/available tokens"

This option is automatic on FAC? When a user is deleted on AD, the mobile token assigned to him is released ?

[xsilver_FTNT]

dabens wrote:

"if user is deleted, manually or due to the fact he is no more matching LDAP filter, then token assigned to him will be released back to pool of free/available tokens"

This option is automatic on FAC? When a user is deleted on AD, the mobile token assigned to him is released ?

Yes, that's default behavior of Remote User Sync Rules on FortiAuthenticator (FAC hereinafter).

So if users present on FAC from previous sync events are not found anymore matching to current state on AD specified by LDAP Filter.

Because and for e.g. user was not deleted from AD, but just moved to another OU that's not matching the scope set by LDAP Filter.

Then those users, present on FAC, are automatically removed from FAC. And if they were provided with token (manually or automatically via sync rule), then those tokens are supposed to be released from under user account and returned back to pool of available tokens for future use.

It applies by default, UNLESS is FAC explicitly set in sync rule to keep those users!

Doable via "Do not delete synced users when they are no longer found on the remote server" switch inside each sync rule.

[dabens]

Very clear , thank you xsilver!