user admin-usergrp

Use this command to configure LDAP/RADIUS/PKI/TACACS+ remote authentication groups that can be used when configuring a FortiWeb administrator account.

Before you can add a remote authentication group, you must first define at least one query for LDAP, RADIUS, or TACACS+ accounts (see user ldap-user or server-policy custom-application application-policy), a PKI user (see user pki-user), or a TACACS+ user (see user tacacs+ user).

For information about certificate-based Web UI login, see the FortiWeb Administration Guide:

https://docs.fortinet.com/fortiweb/admin-guides

To use this command, your administrator account’s access control profile must have either w or rw permission to the authusergrp area. For details, see Permissions.

Syntax

config user admin-usergrp

edit "<group_name>"

config members

edit <entry_index>

set type {ldap | radius | pki | tacacs+}

set ldap-name "<query_name>"

set radius-name "<query_name>"

set tacacs+-name "<tacacs+_name>"

next

end

next

end

Variable	Description	Default
"<group_name>"	Enter the name of the remote authentication group. The maximum length is 63 characters.	No default.
<entry_index>	Enter the index number of the individual entry in the table. The valid range is 1–9,999,999,999,999,999,999.	No default.
type {ldap | radius | pki | tacacs+}	Select the protocol used for the query, LDAP, RADIUS, PKI or TACACS+.	ldap
ldap-name "<query_name>"	Enter the name of an existing LDAP account query. The maximum length is 63 characters. To display the list of existing queries, enter: edit ?	No default.
radius-name "<query_name>"	Enter the name of an existing RADIUS account query. The maximum length is 63 characters. To display the list of existing queries, enter: edit ?	No default.
pki-name "<pki_name>"	Enter the name of an existing PKI user. The maximum length is 63 characters. To display the list of existing queries, enter: edit ?	No default.
tacacs+-name "<tacacs+_name>"	Enter the name of an existing TACACS+. The maximum length is 63 characters. To display the list of existing queries, enter: edit ?	No default.

Example

This example creates a remote authentication group using an existing LDAP user query named LDAP Users 1. Because remote authentication groups use LDAP queries by default, the LDAP query type is not explicitly configured.

config user admin-usergrp

edit "Admin LDAP"

config members

edit 0

set ldap-name "LDAP Users 1"

next

end

next

end

Related topics

• system admin
• user ldap-user
• user pki-user
• user radius-user
• server-policy custom-application application-policy
• user tacacs+ user