Wildcard Admin Authentication

You can use wildcard admin authentication to add the RADIUS and LDAP accounts of a group to FortiSandbox all at once instead of adding each account individually.

To add accounts on a RADIUS server:

This example uses FortiAuthenticator as the RADIUS server.

1. On FortiAuthenticator, create the users.
2. If required, create user groups and assign users to the groups.
   • To specify which devices the users have access to, you can define the group's Attribute ID as Fortinet-Group-Name, and enter a device group name as listed in FortiSandbox as the Value. This allows users in this group to view jobs only from the devices inside of that device group.
   • If the Attribute ID is not defined, when users log into FortiSandbox, device visibility will follow the device group assigned to the RADIUS_WILDCARD administrator, if any exists.

     

3. Create a new RADIUS service client.
   1. Set the client address as the FortiSandbox IP address.
   2. Enter the secret key in the Secret field.
   3. Configure profiles and add the user groups whose users will log into the FortiSandbox.

      

4. On FortiSandbox, set up the RADIUS server in System > RADIUS Servers.
   See RADIUS Servers.
5. Create a new administrator in System > Administrators.
   1. Select RADIUS WILDCARD as the type.
   2. Select the RADIUS Server created in the previous step.
   3. The administrator name is RADIUS_WILDCARD and it cannot be changed. The administrator can be a device user, however, the assigned device group will be overridden if the RADIUS user group has defined the Attribute ID as Fortinet-Group-Name.

To add accounts on an LDAP server:

1. On the FortiSandbox, set up the LDAP server in System > LDAP Server.
   See LDAP Servers.
   In this example, all users from OU=HQ under the LDAP tree dc=example, dc=org will be able to login to FortiSandbox.

   

2. Create a new administrator in the System > Administrators page.
   1. Select LDAP WILDCARD as the Type.
   2. Select the LDAP server from the previous step.
      The administrator name is LDAP_WILDCARD and it cannot be changed.
   3. Click OK.