How to automate Token attribution of users? How to automate mails attribution of users in fortigate.

[AliE]

Hi all,
Since few days, we have started to use FortiToken and 2FA with the Fortigate's solution. Firstly, we have users in our AD, but we couldn't add mails associate in each user automatically. For that, you have to add mails manually for each user. You have any ideas about that?

In addition, we can't automate the distribution of token for users? Because with a hundred users, it's not normal to attribute tokens manually.
Any help would be appreciated.
Thanks,

Ali

[Markus_M · Accepted solution]

Hello,

with the FortiGate you cannot automate this. The FortiAuthenticator is suited better for this than the firewall. FortiGate can communicate to FortiAuthenticator via RADIUS and the FortiAuthenticator can automatically synchronize users from an LDAP server and assign them tokens, put them to specific groups etc.

Example is here:

https://docs.fortinet.com/document/fortiauthenticator/6.1.2/administration-guide/215969/remote-user-...

On the FortiGate you may be only able to add the tokens via some externally written SSH script that would add a user and a token from the pool. Not impossible but it would be challenging.

Your script should have a database of the available tokens and maintain it, i.e. remove a token when it gets assigned, remove a token when a user disappears.

Best regards,

Markus