[SOLVED] Need Suggestions here regarding retrieving user name in traffic log

[syu]

Update:

Configured FSSO with polling mode and username (sAMAccountName) is showing inside the Fortigate user authenticate monitor page, which means Windows users are able to authenticate through the AD and be recognized by Fortigate for internet access. Plus the log automatically resolves the IP to username.

For Mac user or Linux or windows workgroup users, NTLM can be enabled for them to manually type in the accounts after manually add those accounts as LDAP users on Fortigate.

Works pretty good for me so far:)

==============

Here is the scenario, we are trying to setup a Single Sign-On with Fortigate and Windows AD with just polling mode. However, how to get Mac OS traffic be recognized via AD? So how can I have the FSSO user group associated with the firewall policy while still allow the Mac user traffic?

From my test, if a windows user logged to domain already then I apply the firewall policy change to add FSSO user group, the traffic will stop...why? The testing of LDAP is successful on Fortigate though.

One of the mains reason driving the need of Single Sign-On is to show username in the log on Fortigate and FortiAnalyzer. So maybe there is a way on Fortigate to just resolve the user IP address to username without blocking the traffic if resolution failed?

Suggestions please.