Fortinet white logo
Fortinet white logo

CLI Reference

config authentication scheme

config authentication scheme

Configure Authentication Schemes.

config authentication scheme
    Description: Configure Authentication Schemes.
    edit <name>
        set method {option1}, {option2}, ...
        set auth-user-header {string}
        set negotiate-ntlm [enable|disable]
        set kerberos-keytab {string}
        set domain-controller {string}
        set saml-server {string}
        set saml-timeout {integer}
        set oidc-server <name1>, <name2>, ...
        set oidc-timeout {integer}
        set fsso-agent-for-ntlm {string}
        set require-tfa [enable|disable]
        set captcha [enable|disable]
        set captcha-vendor [google-recaptcha-v2-checkbox|google-recaptcha-v2-invisible|...]
        set captcha-site-key {string}
        set captcha-secret-key {string}
        set fsso-guest [enable|disable]
        set user-cert [enable|disable]
        set search-all-ldap-databases [enable|disable]
        set cert-http-header [enable|disable]
        set user-database <name1>, <name2>, ...
        set digest-algo {option1}, {option2}, ...
        set ssh-ca {string}
        set bearer-type {option}
        set bearer-header {string}
        set bearer-format [standard|raw]
    next
end

config authentication scheme

Parameter

Description

Type

Size

Default

name

Authentication scheme name.

string

Maximum length: 35

method

Authentication methods (default = basic).

option

-

Option

Description

ntlm

NTLM authentication.

basic

Basic HTTP authentication.

digest

Digest HTTP authentication.

form

Form-based HTTP authentication.

negotiate

Negotiate authentication.

fsso

Fortinet Single Sign-On (FSSO) authentication.

rsso

RADIUS Single Sign-On (RSSO) authentication.

ssh-publickey

Public key based SSH authentication.

cert

Client certificate authentication.

saml

SAML authentication.

x-auth-user

User from custom HTTP header (default = x-authenticated-user).

ztna-relay

ZTNA relay authentication.

oidc

OpenID Connect.

bearer

Bearer token.

auth-user-header

Override HTTP header used for authenticated user.

string

Maximum length: 255

negotiate-ntlm

Enable/disable negotiate authentication for NTLM (default = disable).

option

-

enable

Option

Description

enable

Enable negotiate authentication for NTLM.

disable

Disable negotiate authentication for NTLM.

kerberos-keytab

Kerberos keytab setting.

string

Maximum length: 35

domain-controller

Domain controller setting.

string

Maximum length: 35

saml-server

SAML configuration.

string

Maximum length: 35

saml-timeout

SAML authentication timeout in seconds.

integer

Minimum value: 30 Maximum value: 1200

120

oidc-server <name>

OpenID Connect servers configuration.

OpenID Connect server list.

string

Maximum length: 79

oidc-timeout

OpenID Connect authentication timeout in seconds.

integer

Minimum value: 30 Maximum value: 1200

120

fsso-agent-for-ntlm

FSSO agent to use for NTLM authentication.

string

Maximum length: 35

require-tfa

Enable/disable two-factor authentication (default = disable).

option

-

disable

Option

Description

enable

Enable two-factor authentication.

disable

Disable two-factor authentication.

captcha

Enable/disable CAPTCHA for form authentication (default = disable).

option

-

disable

Option

Description

enable

Enable CAPTCHA for form authentication.

disable

Disable CAPTCHA for form authentication.

captcha-vendor

Select CAPTCHA vendor (default = google-recaptcha-v2-checkbox).

option

-

google-recaptcha-v2-checkbox

Option

Description

google-recaptcha-v2-checkbox

Google reCAPTCHA v2, with checkbox.

google-recaptcha-v2-invisible

Google reCAPTCHA v2, without checkbox.

google-recaptcha-v3

Google reCAPTCHA v3.

cloudflare-turnstile

Cloudflare Turnstile.

captcha-site-key

CAPTCHA Site Key.

string

Maximum length: 63

captcha-secret-key

CAPTCHA Secret Key.

string

Maximum length: 63

fsso-guest

Enable/disable user fsso-guest authentication (default = disable).

option

-

disable

Option

Description

enable

Enable user fsso-guest authentication.

disable

Disable user fsso-guest authentication.

user-cert

Enable/disable authentication with user certificate (default = disable).

option

-

disable

Option

Description

enable

Enable client certificate field authentication.

disable

Disable client certificate field authentication.

search-all-ldap-databases

Enable/disable searching all LDAP databases to find groups.

option

-

disable

Option

Description

enable

Enable searching for groups in all LDAP databases.

disable

Disable searching for groups in all LDAP databases.

cert-http-header

Enable/disable authentication with user certificate in Client-Cert HTTP header (default = disable).

option

-

disable

Option

Description

enable

Enable client certificate authentication with HTTP header (RFC9440).

disable

Disable client certificate authentication with HTTP header (RFC9440).

user-database <name>

Authentication server to contain user information; "local" (default) or "123" (for LDAP).

Authentication server name.

string

Maximum length: 79

digest-algo

Digest Authentication Algorithms.

option

-

md5 sha-256

Option

Description

md5

MD5.

sha-256

SHA-256.

ssh-ca

SSH CA name.

string

Maximum length: 35

bearer-type

Bearer token type

option

-

access-token

Option

Description

access-token

Access Token.

bearer-header

Bearer token header name (default is Authorization or Proxy-Authorization, based on request type).

string

Maximum length: 255

bearer-format

Bearer token format

option

-

standard

Option

Description

standard

use standard Bearer header format (RFC 6750).

raw

the header value is Api-Key (no Bearer prefix).

config authentication scheme

config authentication scheme

Configure Authentication Schemes.

config authentication scheme
    Description: Configure Authentication Schemes.
    edit <name>
        set method {option1}, {option2}, ...
        set auth-user-header {string}
        set negotiate-ntlm [enable|disable]
        set kerberos-keytab {string}
        set domain-controller {string}
        set saml-server {string}
        set saml-timeout {integer}
        set oidc-server <name1>, <name2>, ...
        set oidc-timeout {integer}
        set fsso-agent-for-ntlm {string}
        set require-tfa [enable|disable]
        set captcha [enable|disable]
        set captcha-vendor [google-recaptcha-v2-checkbox|google-recaptcha-v2-invisible|...]
        set captcha-site-key {string}
        set captcha-secret-key {string}
        set fsso-guest [enable|disable]
        set user-cert [enable|disable]
        set search-all-ldap-databases [enable|disable]
        set cert-http-header [enable|disable]
        set user-database <name1>, <name2>, ...
        set digest-algo {option1}, {option2}, ...
        set ssh-ca {string}
        set bearer-type {option}
        set bearer-header {string}
        set bearer-format [standard|raw]
    next
end

config authentication scheme

Parameter

Description

Type

Size

Default

name

Authentication scheme name.

string

Maximum length: 35

method

Authentication methods (default = basic).

option

-

Option

Description

ntlm

NTLM authentication.

basic

Basic HTTP authentication.

digest

Digest HTTP authentication.

form

Form-based HTTP authentication.

negotiate

Negotiate authentication.

fsso

Fortinet Single Sign-On (FSSO) authentication.

rsso

RADIUS Single Sign-On (RSSO) authentication.

ssh-publickey

Public key based SSH authentication.

cert

Client certificate authentication.

saml

SAML authentication.

x-auth-user

User from custom HTTP header (default = x-authenticated-user).

ztna-relay

ZTNA relay authentication.

oidc

OpenID Connect.

bearer

Bearer token.

auth-user-header

Override HTTP header used for authenticated user.

string

Maximum length: 255

negotiate-ntlm

Enable/disable negotiate authentication for NTLM (default = disable).

option

-

enable

Option

Description

enable

Enable negotiate authentication for NTLM.

disable

Disable negotiate authentication for NTLM.

kerberos-keytab

Kerberos keytab setting.

string

Maximum length: 35

domain-controller

Domain controller setting.

string

Maximum length: 35

saml-server

SAML configuration.

string

Maximum length: 35

saml-timeout

SAML authentication timeout in seconds.

integer

Minimum value: 30 Maximum value: 1200

120

oidc-server <name>

OpenID Connect servers configuration.

OpenID Connect server list.

string

Maximum length: 79

oidc-timeout

OpenID Connect authentication timeout in seconds.

integer

Minimum value: 30 Maximum value: 1200

120

fsso-agent-for-ntlm

FSSO agent to use for NTLM authentication.

string

Maximum length: 35

require-tfa

Enable/disable two-factor authentication (default = disable).

option

-

disable

Option

Description

enable

Enable two-factor authentication.

disable

Disable two-factor authentication.

captcha

Enable/disable CAPTCHA for form authentication (default = disable).

option

-

disable

Option

Description

enable

Enable CAPTCHA for form authentication.

disable

Disable CAPTCHA for form authentication.

captcha-vendor

Select CAPTCHA vendor (default = google-recaptcha-v2-checkbox).

option

-

google-recaptcha-v2-checkbox

Option

Description

google-recaptcha-v2-checkbox

Google reCAPTCHA v2, with checkbox.

google-recaptcha-v2-invisible

Google reCAPTCHA v2, without checkbox.

google-recaptcha-v3

Google reCAPTCHA v3.

cloudflare-turnstile

Cloudflare Turnstile.

captcha-site-key

CAPTCHA Site Key.

string

Maximum length: 63

captcha-secret-key

CAPTCHA Secret Key.

string

Maximum length: 63

fsso-guest

Enable/disable user fsso-guest authentication (default = disable).

option

-

disable

Option

Description

enable

Enable user fsso-guest authentication.

disable

Disable user fsso-guest authentication.

user-cert

Enable/disable authentication with user certificate (default = disable).

option

-

disable

Option

Description

enable

Enable client certificate field authentication.

disable

Disable client certificate field authentication.

search-all-ldap-databases

Enable/disable searching all LDAP databases to find groups.

option

-

disable

Option

Description

enable

Enable searching for groups in all LDAP databases.

disable

Disable searching for groups in all LDAP databases.

cert-http-header

Enable/disable authentication with user certificate in Client-Cert HTTP header (default = disable).

option

-

disable

Option

Description

enable

Enable client certificate authentication with HTTP header (RFC9440).

disable

Disable client certificate authentication with HTTP header (RFC9440).

user-database <name>

Authentication server to contain user information; "local" (default) or "123" (for LDAP).

Authentication server name.

string

Maximum length: 79

digest-algo

Digest Authentication Algorithms.

option

-

md5 sha-256

Option

Description

md5

MD5.

sha-256

SHA-256.

ssh-ca

SSH CA name.

string

Maximum length: 35

bearer-type

Bearer token type

option

-

access-token

Option

Description

access-token

Access Token.

bearer-header

Bearer token header name (default is Authorization or Proxy-Authorization, based on request type).

string

Maximum length: 255

bearer-format

Bearer token format

option

-

standard

Option

Description

standard

use standard Bearer header format (RFC 6750).

raw

the header value is Api-Key (no Bearer prefix).