How to correctly understand and use the "Username format" in the Identity source of Radius Policy I

[Bruce7x2]

Dear Team

I would like to understand how to determine the appropriate "Username format" (username@realm or realm\username or realm/username) to use for each NAS (Radius Client).

Is this adjustment of the "Username format" based on the Radius protocol or some other information? Please help me clarify what information or examples are needed to make the correct selection for the "Username format". Thank you.

[saneeshpv_FTNT]

Hi,

Realms are used to segregate users from different domain/section to authenticate to different remote authentication servers(LDAP/RADIUS). The username format is something you should specify on the FAC while creating the Radius policy. If the user don't follow the username format you have used in the policy while entering the credentials and just simply entered their username, they will get authenticated against the default realm.

Refer to this link for more information:

https://community.fortinet.com/t5/FortiAuthenticator/Technical-Tip-FortiAuthenticator-realm-based-au...

Please let me know if still have any concerns.

Regards,

[Bruce7x2]

Thank you for your response.

I am confused about the examples provided in the reference materials. I would like to clarify the usage of the added WS-2019 (forti.lab) in the examples. If I choose "realm\username" as the Username format, can I successfully log in to the Fortigate by entering "forti.lab\administrator" as shown in the example?

In a more complex scenario, if multiple realms are added to the policies, with realms possibly coming from Windows AD (dome1.local) or a Linux LDAP Server (dome2.local), and the Username format is set to realm\username, can I authenticate using "dome1.local\administrator" or "dome2.local\administrator" for different domain servers?

Please clarify if my understanding is correct.

[saneeshpv_FTNT]

Hi,

Realm is something you defined in your FortiAuthenticator which could be same as your domain name or something else. The username format used here will help you pass on realm information from User to FAC in different ways so that it can apply different settings (backend authentication server) based on the value of your realm.

So your understanding is correct.

Reference:

https://docs.fortinet.com/document/fortiauthenticator/6.5.2/administration-guide/485114/realms

Regards,

[Debbie_FTNT · Accepted solution]

To clarifiy a bit:

- you create realms under Authentication > User Management > Realms

- those realms can have whatever name you assign, and link to either local, or a remote RADIUS/LDAP server typically, so you could have two LDAP servers linked to two realms, ldap1 and ldap2, for example

- you can reference more than one realm in a RADIUS policy

- in that case, the username format becomes important, because it tells FortiAuthenticator how to parse a username.

As an example:
- the RADIUS policy references the realms ldap1 and ldap2 (ldap1 is default), and is set up with username format 'realm\user'; user test1 exists on ldap1 server, and user test2 exists on ldap2 server
-> user 'test1' logs in, those credentials will be checked against ldap1, because it is default realm and the login attempt did not provide any realm information
-> user 'test2' logs in, those credentials will ALSO be checked against ldap1 (default realm as we have no realm info to go off), and this will fail because test2 belongs to ldap2, not ldap1
-> user 'ldap2\test2' logs in, those credentials will be checked against ldap2, as realm information was provided and FortiAuthenticator parses the username as expected

-> user 'test2@ldap2' logs in, those credentials will be checked against ldap1! The realm '@ldap2' was not provided in the expected format, and is thus interpreted as part of the username, NOT as realm information!
-> user 'test1@ldap2' would also be checked against ldap1, same reasoning as above
-> user 'ldap1\test1' would also be checked against ldap1, but the realm specification is technically unnecessary as ldap1 is default realm and all attempts will match that if no realm information is provided

I hope that clears up the realm selection and username format settings?