Administrative domains (ADOMs)

Administrative domains (ADOMs) enable the admin administrator to constrain other FortiWeb administrators’ access privileges to a subset of policies and protected host names. This can be useful for large enterprises and multi-tenant deployments such as web hosting.

ADOMs are not enabled by default. Enabling and configuring administrative domains can only be performed by the admin administrator.

Enabling ADOMs alters the structure of and the available functions in the GUI and CLI, according to whether or not you are logging in as the admin administrator, and, if you are not logging in as the admin administrator, the administrator account’s assigned access profile.

Differences between administrator accounts when ADOMs are enabled

	admin administrator account	Other administrators
Access to config global	Yes	No
Can create administrator accounts	Yes	No
Can create & enter all ADOMs	Yes	No

If ADOMs are enabled and you log in as admin, a superset of the typical CLI commands appear, allowing unrestricted access and ADOM configuration.

config global contains settings used by the FortiWeb itself and settings shared by ADOMs, such as RAID and administrator accounts. It does not include ADOM-specific settings or data, such as logs and reports. When configuring other administrator accounts, an additional option appears allowing you to restrict other administrators to an ADOM.

If ADOMs are enabled and you log in as any other administrator, you enter the ADOM assigned to your account. A subset of the typical menus or CLI commands appear, allowing access only to only logs, reports, policies, servers, and LDAP queries specific to your ADOM. You cannot access global configuration settings, or enter other ADOMs.

By default, administrator accounts other than the admin account are assigned to the root ADOM, which includes all policies and servers. By creating ADOMs that contain a subset of policies and servers, and assigning them to administrator accounts, you can restrict other administrator accounts to a subset of the FortiWeb’s total protected servers.

The admin administrator account cannot be restricted to an ADOM. Other administrators are restricted to their ADOM, and cannot configure ADOMs or global settings.

To enable ADOMs

1. Log in with the admin account.

Other administrators do not have permissions to configure ADOMs.

Back up your configuration. Enabling ADOMs changes the structure of your configuration, and moves non-global settings to the root ADOM. For details about how to back up the configuration, see Backups.

2. Go to System > Status > Status. From the System Information widget, in the Administrative Domains row, click Enable.

FortiWeb terminates the session.


3. Log in again.

When ADOMs are enabled, and if you log in as admin, the navigation menu on the left changes: the top level lists two ADOM items: Global and root.

Global contains settings that only admin or other accounts with the prof_admin access profile can change.

root is the default ADOM.

This menu and CLI structure change is not visible to non-global accounts; ADOM administrators’ navigation menus continue to appear similar to when ADOMs are disabled, except that global settings such as network interfaces, HA, and other global settings do not appear.

4. Continue by defining ADOMs. For details, see Defining ADOMs.

To disable ADOMs

1. Delete all ADOM administrator accounts.

Back up your configuration. Disabling ADOMs changes the structure of your configuration, and deletes most ADOM-related settings. It keeps settings from the root ADOM only. For details about how to back up the configuration, see Backups.

2. Go to System > Status > Status, then in the System Information widget, in the Administrative Domains row, click Disable.
3. Continue by reconfiguring the appliance. For details, see How to set up your FortiWeb.

See also

• Permissions
• Defining ADOMs
• Assigning administrators to an ADOM
• Administrators
• Configuring access profiles

Defining ADOMs

Some settings can only be configured by the admin account—they are global. Global settings apply to the appliance overall regardless of ADOM, such as:

• Operation mode
• Network interfaces
• System time
• Backups
• Administrator accounts
• Access profiles
• FortiGuard connectivity settings
• HA and configuration sync
• SNMP
• RAID
• Vulnerability scans
• exec ping and other global operations that exist only in the CLI

Only the admin account can configure global settings.

In the current release, some settings, such as user accounts for HTTP authentication, anti-defacement, and logging destinations are read-only for ADOM administrators. Future releases will allow ADOM administrators to configure these settings separately for their ADOM.

Other settings can be configured separately for each ADOM. They essentially define each ADOM. For example, the policies of adom-A are separate from adom-B.

Initially, only the root ADOM exists, and it contains settings such as policies that were global before ADOMs were enabled. Typically, you will create additional ADOMs, and few if any administrators will be assigned to the root ADOM.

After ADOMs are created, the admin account usually assigns other administrator accounts to configure their ADOM-specific settings. However, as the root account, the admin administrator does have permission to configure all settings, including those within ADOMs.

To create an ADOM

1. Log in with the admin account.

Other administrators do not have permissions to configure ADOMs.

2. Go to Global > System > Administrative Domain > Administrative Domain.

The maximum number of ADOMs you can add varies by your FortiWeb model. The number of ADOMs is limited by available physical memory (RAM), and therefore also limits the maximum number of policies and sessions per ADOM. See Appendix B: Maximum configuration values.

3. Click Create New, enter the Name, then click OK.

The new ADOM exists, but its settings are not yet configured. Alternatively, to configure the default root ADOM, click root.

4. Do one of the following:

• assign another administrator account to configure the ADOM (continue with Assigning administrators to an ADOM), or
• configure the ADOM yourself: in the navigation menu on the left, click the ADOM list on the top level to display all the ADOMs, click the name of the new ADOM, then configure its policies and other settings as usual.
• configure the ADOM yourself: in the navigation menu on the left, click Administrative Domains, click the name of the new ADOM, then configure its policies and other settings as usual.

See also

• Assigning administrators to an ADOM
• Administrative domains (ADOMs)
• Administrators
• Configuring access profiles
• Permissions

Assigning administrators to an ADOM

The admin administrator can create other administrators and assign their account to an ADOM, constraining them to that ADOM’s configurations and data.

To assign an administrator to an ADOM

1. If you have not yet created any administrator access profiles, create at least one. For details, see Configuring access profiles.
2. In the administrator account’s Access Profile, select the new access profile.

(Administrators assigned to the prof_admin access profile will have global access. They cannot be restricted to an ADOM.)

3. In the administrator account’s Administrative Domain, select the account’s assigned ADOM. Currently, in this version of FortiWeb, administrators cannot be assigned to more than one ADOM.

See also

• Administrators
• Configuring access profiles
• Defining ADOMs
• Permissions