How does Fortinet SSO work?
A quick intro to FSSO
Fortinet Single Sign-on (FSSO) is a nifty feature. It uses passive authentication techniques to associate network traffic with the end user who is generating that traffic. That way, user-specific security policies can be applied. For example: perhaps a FortiGate firewall should only allow staff members in the Accounting department to access a banking web application. In order to do this, the firewall needs to be able to differentiate user traffic.
Let's walk through how this feature works and its high-level architecture. The basic idea is pretty simple:
- Enterprise organizations typically use some sort of centralized authentication and directory service. The most popular one by FAR these days is (still?) Active Directory.
- FSSO components collect and monitor user login activity from an authentication source. There are several different ways this information can be collected:
- Lightweight agents (DC agents, collector agents, etc) can be strategically installed in the environment.
- The FortiGate itself can perform "agentless" polling (usually only suitable for really small networks).
- Once a login event is discovered, details are gathered and stored/mapped on the FortiGate firewall:
- Username
- Host name
- IP address (note that this isn't stored in Windows login events – it's generated via a separate DNS lookup).
- User Group(s)
- On a regular basis, FSSO components perform check-ups to see if a user is still logged in and actively using an IP address. There's a variety of techniques for doing this but some possibilities include:
- A collector agent periodically connecting to individual user workstation via Windows Management Instrumentation (WMI) and querying to see if the user is still active.
- "Dead entry timeout intervals" (a timeout after which the feature considers the user no longer present).
The benefit here is that this happens behind the scenes without requiring any additional manual effort by the user. Once the FortiGate has this level of detail, it can apply/enforce much more specific policies.
For more information, check out these articles and resources:
Debbie_FTNT
dgough
Mike
