I have a problem I was hoping to get some help with. First some background.
We use Securenvoy for two factor authentication. Securenvoy is a quite limited radius server. We want to allow users to log on to ssl vpn with securenvoy providen second factor, while we limit permissions in the policy set with other ldap groups.
So the user is member of one group which makes securenvoy to authenticate the user, and also one or more AD groups which are supposed to grant access to different parts of the network. We are hoping there is a possibility to pass back the username from radius and use this to populate firewall ldap groups. I don't know if this is making sense, but I'll continue anyhow.
We have tried to to do this with RSSO, but we have 3 problems with this approach:
1. Securenvoy is a limited radius server and does not support multiple network policies
2. Using NPS to forward radius request to securenvoy works, but I cannot get the accounting to work.
3. How will this work with user being member of multiple ad groups?
Our other SSL VPN solution from juniper solves this by using both Radius and LDAP in the authorization process. First it authenticates with radius, then checks ldap for group membership. We were hoping to do much the same here with one group to allow access to a tunnel based portal, and ad groups in firewall policies to grant access to networks. We can still use juniper, but I would like to get ridd of it to keep operational complexity at a minimum.
Hopefully someone can shed some light on this, and tell me if it is possible or not.
Sadly it does not seem to work. As soon as it hits the radius server it stops group matching:
[left]fnbamd_auth.c fnbamd_auth_handle_radius_result-Skipping group matchingfnbamd_fsm.c find_matched_usr_grps-Skipped group matching[/left]
I have so far only managed to radius authenticate with a firewall group, and not a user. When trying with a user I get fnbamd_framed_ip_delete_ip-Didn't delete IP 0.0.0.0; no IPs for vfid 4 which might be because of something I've done on the radius server.
Would it be possible to combine radius authentication with FSSO agent on the domain controllers?
No I'm guessing I FSSO agent needs the correct IP for the user mapping to work, and authentication happens before IP delegation. I tried changing the user account from radius to firewall type, and the result was that it does not seem to query any of the remote authentication servers.
Basically this seems to be the behaviour:
If radius user/group are placed in the first policy (sequence) it checks radius, if success it stops group mapping
If ldap group are placed in the first policy (sequence) it checks ldap first, if success it stops group mapping
If a local (firewall) user is configured with the username which I'm trying to log in with, it does not check any remote authentication methods.
Oc course ut might be me misunderstanding your suggestions, I will try to trim down the config file when I have the time and post it.
Right now my only hope seems to be RSSO and using a Microsoft NPS i between fortigate and securenvoy. Hopefully I can manage to create a network policy which sends some attributes back to fortigate and then manage to get the fortigate to do something usefull with that attribute.
If there are any other suggestion I aappreciate the effort, if not I think I will send a request for new feature in Fortinet's direction.
I forgot to mentions it but it is a 1500D HA cluster and running 5.2.4
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.