WiFi using FortiAuthenticator RADIUS with certificates

[TheOnlyJames]

Following this link - https://docs.fortinet.com/document/fortiauthenticator/6.0.0/cookbook/812128/creating-a-local-ca-on-f...

I am a little confused, the cookbook suggests you have to create a user certificate? i have over 500 LDAP users, that cant be right can it? it also suggests you create the local users on the FAC? thats a bit pointless, my FAC is connected to AD, so why would I need to create the users again,  Im looking for a solution where the users connected to the business WIFI, using their machine certs, not sure why we need user certs, is it another check or something? thanks

[ebilcari]

This a new option added in later versions of FAC, I guess you are still on the 6.4 firmware. Try to upgrade to the 6.5 firmware branch, the screenshot is from a FAC running 6.5.5.

[TheOnlyJames]

I am on 6.6.0, i created a new Policy and then was able to select cert, so this option, purely looks at the cert and lets the user authenicate, nothing else, whereas the other option does what? its the same thing?

[ebilcari]

Like shown also from within the FAC GUI, the bindings has an extra verification step. It will try to match the CN of the certificate to the username of a local/remote user. If that doesn't match the authentication will fail:

[TheOnlyJames]

Hi this isnt working the way I expected, may I clarify something?

Radius Policy:

Added the Fortigates as radius clients 

Radius Attribute - Added the SSID that users will connect to for EAP-TLS 

Authentication type - Client Certificates (EAP-TLS)

Identity Sources - this was set to trusted CAs, which is not right, as it just checks the cert, I need it to check AD as well, so I have changed this to Certificate bindings and have selected the AD group "ALLOWED EAP-TLS USERS" on the filter, this is how it should be yes?

On the Realm I am using an LDAP server, is this all I need? many thanks

[The_Nude_Deer]

right! so this is the method I need to use. USER CERT, then checked in LDAP.. so its the 2nd option I need. right? thank you, there just isnt a clear guide for that option! still looking

[The_Nude_Deer]

Has anyone done this at all? it just isn't even close to working, despite configuring everything from the cook books and discussions here