Hey everyone, I've hit a real head-scratcher with my FortiGate setup and could use some collective wisdom. I'm trying to enforce two-factor authentication for admin logins, but *only* for users in specific LDAP groups. The rest should just use their regular LDAP credentials.
I've got the LDAP server configured and working for standard authentication. The 2FA works if I set it globally on the admin account itself, but that's not the goal. I want the 2FA policy to trigger based on group membership.
Here's what I've tried so far:
* Created a user group in the FortiGate that points to my LDAP security group (let's call it "Network-Admins").
* Set up a local user for the same person (matching the LDAP username) and enabled FortiToken Mobile for them.
* Created a firewall policy for my management interface (HTTPS/SSH) using that LDAP group as the source, requiring 2FA.
The LDAP auth part works, but it never prompts for the second factor. It just logs them in. I feel like I'm missing a link between the LDAP group membership and the token assignment.
Has anyone successfully layered 2FA onto LDAP groups for admin access? Specifically:
* Did you assign the token to the local "user" entry that mirrors the LDAP username?
* Is there a specific order in the authentication flow I might have wrong?
* Any hidden "gotchas" in the CLI that aren't obvious in the GUI?
I'm used to tools like Jira and Asana where group-based permissions are pretty straightforward, but the FortiGate's auth chain is proving trickier. Any workflow tips or config snippets would be a huge help!
Cheers