Radius user group mapping problem

[yugiohx]

Hello everybody, I have a Fortinet VM-64 (version v5.4.7,build6446 ) to provide SSLVPN service. My customer provides a radius server for SSLVPN authentication. But their radius server can't response group information when doing authentication. So I create many account with radius on the VM-64, and mapping them with different group. But there is a problem with group mapping. When client use a account which exist in the radius server but doesn't exist in the VM-64 to login SSLVPN, it will login success and mapping to group for the first account in the account list. For example: ----------------- I have two account in the VM-64. AAA in radius is group-X  (It's the first account in the list) BBB in radius is group-Y There are three account in the radius server.(Because the radius server is not only for SSLVPN) AAA BBB CCC When client use CCC to login SSLVPN, he will login success and mapping to group-X. ------------------- Because different group have different access control list, so it will be a issue in security. And it's strange to mapping a account which doesn't exist to a exist group. It look like a vulnerability or program logic error in the authentication? Could you kindly give me some suggestion to resolve it? Thanks a lot : )

[emnoc]

Yes , I have to agree with the last pose VSA is what you want and if you have a RADIUS server that does not  recognize VSA than abandon it 

FWIW here the  fortinet VSA

http://kb.fortinet.com/kb/viewContent.do?externalId=FD36919&sliceId=1

[yugiohx]

Thanks for reply: )

I agree with the solution which if radius can reply group attribute.

But the guys manage the radius is a senior engineer who don't like to change things.

It's diffcult to ask him to editing about 200 account for me....Orz

[emnoc]

Changing the  user or use a Radius-aaS  like jumpcloud 

Ken 

[yugiohx]

Thank you for reply: )

I can't agree you anymore.

But the user is our customer.

So that I think the user is more important than me. hahahahah

[marco_digirolamo]

Be sure you don't flag this option when you configure Radius server, or any user could be able to authenticate against it also if not mapped anywhere (see image attached).

[Hashim_Nangarhari]

Hello 

what (include in every user group) is about from practical perspective 

lets suppose that I have a local group in fortigate named GuestUsers which includes the local users :ahmad,david and

sami. what this option will add to this group ?

[marco_digirolamo]

If you flag that option you permit every user group in your fortigate to check credentials on radius server unless specifications, so if you have a radius policy on your radius server that matches unconditionally, a user could successfully login against this method also if not mapped anywhere.

[Hashim_Nangarhari]

thank you for your reply.

[ck888]

Hello everybody,   i have few user group in the radius server (windows server base) and would like to assign different access permission for those group.   When i configure user group with radius and the group configure "specify", the authentication is not working. If i put any in the group option that is working fine but that is not fulfil the design (assign  different user group with different access permission) May i know is there pre-requisite requirement to configure "specify group?   I did some research that said use "AVP" to mapping radius user group. May i know is that compulsory use "AVP or other way can map the radius user group?   Thanks.

[xsilver_FTNT]

as I said in second update in this thread .. reading comments DOES help, really.

And as I replied directly to your same question .. https://forum.fortinet.com/tm.aspx?tree=true&m=199827

That feature is usually referenced as "RADIUS group match". And I hope that this KB will clarify all that: https://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=FD36464

More precisely, AVP you are looking for is in the middle of the doc in FreeRADIUS config example, and in packet capture below, and it is "Fortinet-Group-Name". FGT does full and clear string match of received Fortinet-Group-Name against what's in "set group-name" in config match in user group (on FGT).