Technical Tip: Wildcard admin profile does not work on FortiGate

anoushiravan · ‎03-29-2024

Description

This article describes that an admin account is generally used to manage the FortiGate using GUL, and SSH access.

When the admins are part of a group on any remote server like LDAP, radius, etc, it is possible to use a wildcard option in the admin profile to avoid
creating multiple admin accounts on FortiGate, wildcard option is used to match one local admin account with the remote group.

Scope

FortiGate.

Solution

On FortiGate as per the current design, only one wildcard admin account can be used to match the admin and other configured wildcard admin profiles will be ignored, therefore for different wildcard admin profiles, the customer needs to submit an NFR, otherwise an individual admin profile with the exact name of the remote use should be created on FortiGate, in this case, FortiGate will check the individual admin profile before a wildcard admin profile.

The below example is the config and debugging of the wildcard admin profile, and the requirement is the admin should be able to access only VDOM names 'sales':

In the below scenario, the admin is part of both groups on both remote tacas+ servers but since the admin can access only one VDOM named 'Sales'.

Therefore, the expectation is a group 'server.tacacs.admin' should be matched while it is possible to see the group 'fac.tacacs.group' under the upper wildcard admin profile 'fac.tacacs.admin' is examined:

config system admin
edit "fac.tacacs.admin"
set remote-auth enable
set accprofile "super_admin"
set vdom "root" <---
set wildcard enable <---
set remote-group "fac.tacacs.group"
next
edit "server.tacacs.admin"
set remote-auth enable
set accprofile "super_admin"
set vdom "sales" <---
set wildcard enable <---
set remote-group "server.tacacs.group"
next
end

config user tacacs+
edit "fac.tacas+"
set server "10.125.5.135"
set key ENC EVvOGEr40yyHIZv71sRZmgcssI4wvb91QnkmbsVu6JBSoLaAbfNoa3FAXzKOUDtsx/F4nNfxAXr0qW+NSPkPJ2eGADJWORzdSfuIgXfnKiL3RP++rF8NzUedl8wf774D0jzcWnZPa1wJQwgioPvrNR2jUcmrVwQzr3Fe3XdlkH8IO8di4xOV/5lzXBoFZ0AHnfoNbw==
next
edit "server.tacas+"
set server "10.160.5.136"
set key ENC EVvOGEr40yyHIZv71sRZmgcssI4wvb91QnkmbsVu6JBSoLaAbfNoa3FAXzKOUDtsx/F4nNfxAXr0qW+NSPkPJ2eGADJWORzdSfuIgXfnKiL3RP++rF8NzUedl8wf774D0jzcWnZPa1wJQwgioPvrNR2jUcmrVwQzr3Fe3XdlkH8IO8di4xOV/5lzXBoFZ0AHnfoNbw==
next
end

config user group
edit "fac.tacacs.group"
set member "fac.tacas+"
next
edit "server.tacacs.group"
set member "server.tacas+"
next
end

As shown in debugging logs, only the remote group 'fac.tacacs.group' under the wildcard admin profile 'fac.tacacs.admin' is checked by FortiGate to match the user 'soniya'.

As a result, the user will be able to access 'root' VDOM, and the group 'server.tacacs.group' will not be matched since only one wildcard admin profile can be used on FortiGate based on the FortiOS design:

Spoke1 # di de dis
Spoke1 # di de reset
Spoke1 # di de cons time enable
Spoke1 # di de app fnbamd -1
Debug messages will be on for 30 minutes.
Spoke1 # di de app httpsd -1
Debug messages will be on for 30 minutes.
Spoke1 # di de enable

Spoke1 # 2024-03-06 12:26:05 [httpsd 10613 - 1709724365 info] fweb_debug_init[417] -- New POST request for "/logincheck" from "172.26.61.4:52881"
2024-03-06 12:26:05 [httpsd 10613 - 1709724365 info] fweb_debug_init[419] -- User-Agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0"
2024-03-06 12:26:05 [httpsd 10613 - 1709724365 info] fweb_debug_init[421] -- Handler "logincheck-handler" assigned to request
2024-03-06 12:26:05 [httpsd 10613 - 1709724365 info] logincheck_handler[421] -- entering vdom for login_attempt (vdom='root')
2024-03-06 12:26:05 [1916] handle_req-Rcvd auth req 471980690 for soniya in fac.tacacs.group opt=00014001 prot=11
2024-03-06 12:26:05 [475] __compose_group_list_from_req-Group 'fac.tacacs.group', type 1
2024-03-06 12:26:05 [616] fnbamd_pop3_start-soniya
2024-03-06 12:26:05 [2255] fnbamd_user_ldap_create-LDAP servers are created, vfid=0, total=1
2024-03-06 12:26:05 [378] radius_start-Didn't find radius servers (0)
2024-03-06 12:26:05 [1068] __tac_plus_try_next_server-Try fac.tacas+:10.125.5.135
2024-03-06 12:26:05 [358] __tac_plus_dns_cb-Resolved fac.tacas+:10.125.5.135 to 10.125.5.135, cur stack size:1
2024-03-06 12:26:05 [278] sock_connect-connecting fac.tacas+:10.125.5.135: 10.125.5.135
2024-03-06 12:26:05 [491] ldap_start-Didn't find ldap servers
2024-03-06 12:26:05 [642] create_auth_session-Total 1 server(s) to try
2024-03-06 12:26:05 [390] is_sock_connected-tcp connected
2024-03-06 12:26:05 [497] build_authen_start-building authen start packet: authen_type=2(pap)
2024-03-06 12:26:05 [763] tac_plus_result-Authen sending request
2024-03-06 12:26:05 [405] pak_send-Encrypting pkt
2024-03-06 12:26:05 [1210] fsm_tac_plus_update_result-Continue pending for req 471980690
2024-03-06 12:26:05 [773] tac_plus_result-Authen receiving reply
2024-03-06 12:26:05 [462] pak_recv-read all header, data len 6
2024-03-06 12:26:05 [1210] fsm_tac_plus_update_result-Continue pending for req 471980690
2024-03-06 12:26:05 [773] tac_plus_result-Authen receiving reply
2024-03-06 12:26:05 [557] parse_authen_reply-authen result=1(pass)
2024-03-06 12:26:05 [1658] fnbam_user_auth_group_match-req id: 471980690, server: fac.tacas+, local auth: 0, dn match: 0
2024-03-06 12:26:05 [286] find_matched_usr_grps-Passed group matching
2024-03-06 12:26:05 [216] fnbamd_comm_send_result-Sending result 0 (nid 0) for req 471980690, len=2092
2024-03-06 12:26:05 [798] destroy_auth_session-delete session 471980690
2024-03-06 12:26:05 [1077] tac_plus_destroy-fac.tacas+
2024-03-06 12:26:05 [httpsd 10613 - 1709724365 info] logincheck_handler[523] -- login attempt OK, VDOM updated to 'root'
2024-03-06 12:26:05 [httpsd 10613 - 1709724365 info] logincheck_handler[529] -- login_attempt (method=5, vdom='root', name='soniya',admin_name='fac.tacacs.admin', auth_svr='fac.tacas+') <
2024-03-06 12:26:05 [httpsd 10613 - 1709724365 info] output_response[58] -- sent response (status='1', buf='document.location="/prompt?viewOnly&redir=%2F";
')
2024-03-06 12:26:05 [httpsd 10613 - 1709724365 info] fweb_debug_final[306] -- Completed POST request for "/logincheck" (HTTP 200)
2024-03-06 12:26:06 [httpsd 10613 - 1709724366 info] fweb_debug_init[417] -- New GET request for "/api/v2/monitor/web-ui/node-auth" from "172.26.61.4:52881"
2024-03-06 12:26:06 [httpsd 10613 - 1709724366 info] fweb_debug_init[419] -- User-Agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0"
2024-03-06 12:26:06 [httpsd 10613 - 1709724366 info] fweb_debug_init[421] -- Handler "api_monitor_v2-handler" assigned to request