Fortinet black logo

Handbook

Configuring user groups

Configuring user groups

User groups are authorized by the virtual server authentication policy. The user group configuration references the authentication servers that contain valid user credentials.

Suggested steps:

  1. Configure LDAP, RADIUS, and NTLM servers, if applicable.
  2. Configure local users.
  3. Configure user groups (reference servers and local users).
  4. Configure an authentication policy (reference the user group).
  5. Configure the virtual server (reference the authentication policy).

Before you begin:

  • You must have created configuration objects for any LDAP, RADIUS, NTLM servers you want to use, and you must have created user accounts for local users.
  • You must have read-write permission for System and User settings.

After you have created user groups, you can specify them in the server load balancing authentication policy configuration.

To configure a user group:
  1. Go to User Authentication > User Group.
  2. Click Create New to display the configuration editor.
  3. Complete the configuration as described in User group configuration.
  4. Save the configuration.

User group configuration

Settings Guidelines

Name

Configuration name. Valid characters are A-Z, a-z, 0-9, _, and -. No spaces.

After you initially save the configuration, you cannot edit the name.

User Cache

Enable to cache the credentials for the remote users (LDAP, RADIUS) once they are authorized.

Cache Timeout

Timeout for cached user credentials. The default is 300 seconds. The valid range is 1-86,400 seconds.

Authentication Timeout

Timeout for query sent from FortiADC to a remote authentication server. The default is 2,000 milliseconds. The valid range is 1-60,000 milliseconds.

Authentication Log

Specify one of the following logging options for authentication events:

  • No logging
  • Log failed attempts
  • Log successful attempts
  • Log all (both failed and successful attempts)

Client Authentication Method

  • HTML Form
  • HTTP
  • NTLM (only if you want to use NTLM server as authentication server)

Group Type

  • Local—Default. No action is needed.
  • SSO—Select to enable single sign-on (SSO) and then populate the fields below.

Authentication Relay

Select an authentication relay profile.

Authentication Session Timeout

Specify the authentication session timeout. Valid values range from 1 to 180 minutes. The default is 3 (minutes).

SSO Support

Disabled by default. When enabled, you must specify the SSO domain. See below.

Note: Let's suppose that you add two or more virtual servers on FortiADC and they all use the same authentication relay, and then you set the Group Type (above) to SSO and enable SSO Support. When a client visits different services within the defined domain, only in the first request needs to be authenticated. Once authenticated, the client can visit all other services in the same domain.

SSO Domain

Specify the SSO domain.

Log-off URL

Specify the log-off URL.

Configuring user groups

User groups are authorized by the virtual server authentication policy. The user group configuration references the authentication servers that contain valid user credentials.

Suggested steps:

  1. Configure LDAP, RADIUS, and NTLM servers, if applicable.
  2. Configure local users.
  3. Configure user groups (reference servers and local users).
  4. Configure an authentication policy (reference the user group).
  5. Configure the virtual server (reference the authentication policy).

Before you begin:

  • You must have created configuration objects for any LDAP, RADIUS, NTLM servers you want to use, and you must have created user accounts for local users.
  • You must have read-write permission for System and User settings.

After you have created user groups, you can specify them in the server load balancing authentication policy configuration.

To configure a user group:
  1. Go to User Authentication > User Group.
  2. Click Create New to display the configuration editor.
  3. Complete the configuration as described in User group configuration.
  4. Save the configuration.

User group configuration

Settings Guidelines

Name

Configuration name. Valid characters are A-Z, a-z, 0-9, _, and -. No spaces.

After you initially save the configuration, you cannot edit the name.

User Cache

Enable to cache the credentials for the remote users (LDAP, RADIUS) once they are authorized.

Cache Timeout

Timeout for cached user credentials. The default is 300 seconds. The valid range is 1-86,400 seconds.

Authentication Timeout

Timeout for query sent from FortiADC to a remote authentication server. The default is 2,000 milliseconds. The valid range is 1-60,000 milliseconds.

Authentication Log

Specify one of the following logging options for authentication events:

  • No logging
  • Log failed attempts
  • Log successful attempts
  • Log all (both failed and successful attempts)

Client Authentication Method

  • HTML Form
  • HTTP
  • NTLM (only if you want to use NTLM server as authentication server)

Group Type

  • Local—Default. No action is needed.
  • SSO—Select to enable single sign-on (SSO) and then populate the fields below.

Authentication Relay

Select an authentication relay profile.

Authentication Session Timeout

Specify the authentication session timeout. Valid values range from 1 to 180 minutes. The default is 3 (minutes).

SSO Support

Disabled by default. When enabled, you must specify the SSO domain. See below.

Note: Let's suppose that you add two or more virtual servers on FortiADC and they all use the same authentication relay, and then you set the Group Type (above) to SSO and enable SSO Support. When a client visits different services within the defined domain, only in the first request needs to be authenticated. Once authenticated, the client can visit all other services in the same domain.

SSO Domain

Specify the SSO domain.

Log-off URL

Specify the log-off URL.