Local user accounts can be created, imported, exported, edited, and deleted as needed. Expired local user accounts can be purged manually or automatically (see User account policies).
To manage local user accounts, go to Authentication > User Management > Local Users.
The local user account list shows the following information:
|Create New||Select to create a new user.|
If using a CSV file, it must have one record per line, with the following format: user name (30 characters max), first name (30 characters max), last name (30 characters max), email address (75 characters max), mobile number (25 characters max), password (optional, 128 characters max), two-factor auth, custom field 1, custom field 2, custom field 3, enable FortiToken-auth only (no password), and group names.
If the optional password is left out of the import file, the user is emailed temporary login credentials and requested to configure a new password.
Note that, even if an optional field is empty, it still must be defined with a comma.
Multiple groups can be separated by a semi-colon, e.g., g1;g2;g3.
Import error handling: If any error is detected (e.g., duplicate user, invalid field, etc), none of the local user accounts from the CSV file are created. For FortiAuthenticator to successfully add the imported local users from a CSV file to the specified groups:
|Export Users||Select to export the user account list to a CSV file.|
|Edit||Select to edit the selected user account.|
|Delete||Select to delete the selected user account or accounts.|
Purge Disabled: This offers the option to choose which type of disabled users to purge. All users matching the type(s) selection are deleted.
Re-enable: This allows the administrator to re-enable disabled accounts. Expired users accounts can only be re-enabled individually.
|Search||Enter a search term in the search field, then select Search to search the user account list.|
|User||The user accounts’ usernames.|
|First name||The user accounts’ first names, if included.|
|Last name||The user accounts’ last names, if included.|
|Email address||The user accounts’ email addresses, if included.|
|Admin||If the user account is set as an administrator, a green circle with a check mark is shown.|
|Status||If the user account is enabled, a green circle with a check mark is shown.|
|Token||The token that is assigned to that user account. Select the token name to edit the FortiToken, see FortiToken device maintenance.|
|Token requested||The status of the user's token request.|
|Groups||The group or groups to which the user account belongs.|
|Authentication Methods||The authentication method used for the user account.|
|Expiration||The date and time that the user account expires, if an expiration date and time have been set for the account.|
When creating a user account, there are three ways to handle the password:
- The administrator assigns a password immediately and communicates it to the user.
- FortiAuthenticator creates a random password and automatically emails it to the new user.
- No password is assigned because only token-based authentication will be used.
- In the local users list, select Create New. The Create New Local User window opens.
- Enter the following information:
Username Enter a username for the user. Password creation
Select one of the options from the dropdown menu:
- Specify a password: Manually enter a password in the Password field, then reenter the password in the Password confirmation field.
- Set and email a random password: Enter an email address to which to send the password in the Email address field, then reenter the email address in the Confirm email address field.
- No password, FortiToken authentication only: After you select OK, you will need to associate a FortiToken device with this user. See FortiToken physical device and FortiToken Mobile.
Allow RADIUS authentication For a user to authenticate using RADIUS, this must be enabled. Force password change on next logon Enable or disable the option for users to change their local password on FortiAuthenticator at first logon. This feature prevents administrators from having to call or email the franchisee to deliver user credentials, which is not a secure method of delivery and adds additional time to the onboarding process. Role
Select whether the new account is for an Administrator, Sponsor, or regular User. Administrators can either have full permissions or have specific administrator profiles applied. Regular users can have their account expiration settings configured.
When creating a new administrator account, you are prompted to enter the password of the currently logged in administrator before changes can be saved.
Enable account expiration Select to enable user account expiration, either after a specific amount of time has elapsed, or on a specific date. Expire after
- Set length of time: Enter the number of hours, days, months, or years until the account expires.
- Set an expire date: Enter the date on which the account will expire, either by manually typing it in, or by selecting the calendar icon and selecting a date.
Add this local user to an IAM account.
- Select OK to create the new user. You are redirected to the Change local user window to continue the user configuration in greater detail.
If the password creation method was set to No password, FortiToken authentication only, you are required to associate a FortiToken with the user before the user can be enabled.
User accounts can be edited at any time. To edit a user, go to the user account list, select a user to edit, and select Edit from the toolbar. Conversely, select the username in the user list.
The following information can be viewed or configured:
|Username||The username cannot be changed.|
|Disabled||Select to disable the user account.|
The user's password can be changed by selecting Change Password.
|Token-based authentication||Select to enable FortiToken-based authentication. See Configuring token-based authentication.|
|Allow RADIUS authentication||Select to allow RADIUS authentication. This applies only to regular users.|
|Enable account expiration||Select to enable account expiration and specify the account's expiration. See Enable account expiration.|
Force password change on next logon
Require the user to change their password on their next logon. Once changed, this setting will be automatically disabled again.
|Sync in HA Load Balancing mode||
Select to sync the administrator across load-balanced FortiAuthenticator devices from the primary standalone device to load-balancers.
|User Role||Configure the user’s role.|
Select Administrator, Sponsor, or User.
If setting a user as an administrator, see Configuring a user as an administrator.
|Allow LDAP browsing||Select to allow LDAP browsing. This applies only to regular users.|
|Full permission||Enable to grant this administrator full permission, or enter an Admin profile in the field provided. This applies only to administrators.|
|Web service access||
Enable to allow this administrator to access the web services either through a REST API or using a client application. This applies only to administrators.
After enabling Web service access and saving your changes, the User API Access Key window is displayed allowing you to view, copy, and/or email the API access key.
|Restrict admin login from trusted management subnets only||Enable and enter trusted IP addresses and netmasks for restricted administrator login access. This applies only to administrators.|
|User Information||Enter user information, such as their address and phone number. See Adding user information.|
|Alternative email addresses||
Add alternate email addresses for the user.
|Password Recovery Options||Configure password recovery options for the user. See Configuring password recovery options|
|Groups||Assign the user to one or more groups. See Local users.|
|Usage Information||View the user's usage information, including bytes in/out, time used, and the option to reset the usage statistics.|
|Email Routing||Enter a mail host and routing address into their respective fields to configure email routing for the user.|
Add a TACACS+ authorization rule. See Assigning authorization rules.
Add RADIUS attributes. See RADIUS attributes.
Add, edit, or removed certificate bindings for the user account. See Configuring certificate bindings.
|Devices||Add devices, based on MAC address, for the user account.|
Select OK when you have finished editing the user’s information and settings.
Token-based authentication requires either a FortiToken device or a mobile device with the FortiToken Mobile app installed, or a device with either email or SMS capability.
FortiToken and FortiToken Mobile tokens must first be registered under Authentication > User Management > FortiTokens. For more information, see FortiTokens.
- To view the token-based authentication options, edit a user and select Token-based authentication.
- Select one of the following token delivery methods:
FortiToken, then select the type of FortiToken used from the available options.
- Hardware, then select the FortiToken device serial number from the Token dropdown menu.
- Mobile, then select the FortiToken Mobile device serial number from Token dropdown menu, and select an Activation delivery method from Email or SMS.
- Cloud, then select an Activation delivery method from Email or SMS.
- Email, then enter the user’s email address in the User Information section.
- SMS, then enter the user’s mobile number in the User Information section.
- Dual (Email & SMS), then enter the user's email address and mobile number in the User Information section.
The device must be known to FortiAuthenticator. See FortiToken physical device and FortiToken Mobile.
Optionally, select Temporary token to receive a temporary token code via email or SMS.
If the Temporary token is enabled with Email or SMS, the user configured for 2FA receives an OTP via email or SMS when attempting a 2FA login. This helps the user access the network with a temporary OTP in case they do not have access to their phone or a hardware token.
The temporary token based authentication is automatically disabled the next time the end-user does a successful login using their FTK/FTM.
- FortiToken, then select the type of FortiToken used from the available options.
- Select Test Token to validate the token passcode. The Test Email Token or Test SMS Token window opens (depending on your selection).
- For email and SMS tokens, confirm that the contact information is correct, select Next, then enter the token code received via email or SMS.
- Select Back to return to edit the contact information, select Verify to verify the token passcode, or select Resend Code if a new code is required.
- For FortiToken, enter the token code in the Token code field, then select Verify to verify the token passcode.
- Select OK.
By default, token code verification must be completed within 60 seconds after the token code is sent by email or SMS. To change this timeout, go to Authentication > User Account Polices > Tokens and modify the Email/SMS Token timeout field. For more information, see Lockouts.
For more information, see Administrators.
- Edit a user and set Role to Administrator under the User Role section.
- Enable Full permission to give the administrator full administrative privileges, or enter Admin profiles to customize the administrator’s permissions.
- Optionally, enable Web service access to allow the administrator to access the web services via a REST API or FortiAuthenticator Agent for Microsoft Windows.
- Select Restrict admin login from trusted management subnets only, then enter the IP addresses and netmasks of trusted management subnets in the table, to restrict the subnets from which an administrator can log in.
- Select Sync in HA Load Balancing mode to allow the administrator to be synced from the primary standalone device to load balancers in an HA load balancing configuration.
- Select OK to save your changes.
A dialog appears requesting the password for the currently logged in admin account. Enter your password and click Validate.
Some user information can be required depending on how the user is configured. For example, if the user is using token-based authentication by SMS, a mobile number and SMS gateway must be configured before the user can be enabled.
The following user information can be entered:
|First name||Last name|
|Email address||Phone number|
|Mobile number||SMS gateway: select from the dropdown menu. Select Test SMS to send a test message.|
|Country: Select from the dropdown menu.|
|Language: Select a specific language from the dropdown menu, or use the default language.|
|FortiToken Logo: Select a FortiToken Mobile logo from the dropdown menu. See FortiTokens.|
To replace a lost or forgotten password, FortiAuthenticator can send the user a password recovery link by email or in a browser in response to a pre-arranged security question. The user must then set a new password.
- Edit a user and ensure that the user has an email address entered. See Adding user information.
- Under Password Recovery Options section, enable Email recovery.
In the event that additional email addresses have been configured under Alternative Email Addresses, an email is sent to all configured email addresses.
- Select OK to apply the changes.
- Edit a user and, under Password Recovery Options, enable Security question, and select Edit.
- Choose one of the questions from the dropdown menu, or select Write my own question and enter a question in the Custom question field.
- Enter the answer for the question in the Answer field.
- Select OK to create the security question.
- Select OK again to apply the changes to the user account.
- Log in to the user account.
- Select Edit Profile at the top left of the page.
- Under Password Recovery Options, select Security Question, and select Edit.
- Choose one of the questions in the list, or select Write my own question and enter a question in the Custom question field.
- Enter the answer for your question.
- Select OK.
- Log in to the user account.
- Select Edit Profile at the top left of the page.
- Under Password Recovery Options, select Email recovery.
- Optionally, select Alternative email addresses and enter additional email addresses for this user.
- Select OK.
- Browse to the IP address of the FortiAuthenticator.
- At the login screen, select Forgot my password.
- Select to recover your password either by Username or Email.
- Enter either your username or email address as selected in the previous step, and select Next.
- Do one of the following:
- If an email address was entered, check your email, open the email and select the password recovery link.
- If a username was entered, answer the security question and select Next.
- On the Reset Password page, enter and confirm a new password and select Next.
Security policies must be in place on the FortiGate unit to establish these sessions.
This information is used to select the user account. If your information does not match a user account, password recovery cannot be completed.
The user can now authenticate using the new password.
To allow Active Directory (AD) users to reset their password from the main login page, follow the same workflow for resetting a local user's password described above.
The Password Recovery Options setting is included in the remote LDAP users configuration page.
This feature is available for both self-service and guest portals.
- Create a user certificate for the user (see To create a new certificate: for more information).
- Create a binding to that certificate in the user’s account.
- Edit a user and expand the Certificate Bindings section.
- Select Add Binding.
- Select either Local CA or Trusted CA from the CA certificate dropdown menu, and select the applicable CA certificate.
- Enter the Common Name on the certificate. For example, if the certificate says
- Select OK to add the new binding.
FortiAuthenticator protects local user account passwords in its storage using cryptography:
- Password storage for local user accounts with the "sponsor" or "administrator" role always uses irreversible cryptography (i.e. bcrypt hash).
- Password storage for local user accounts with the "user" role depends on the Enhanced cryptography for storage of local user passwords option under Authentication > User Account Policies > General:
- If enabled, irreversible cryptography (i.e. bcrypt hash) is used.
- If disabled, reversible cryptography (i.e. AES256) is used.