Identity and Access Management Fundamentals
What this domain tests
Identity and Access Management Fundamentals covers the vocabulary and models the rest of the FortiAuthenticator exam assumes: AAA, identity sources, authentication factors, authorization, SSO, and federation. Questions often ask you to classify a task or identify which component makes a decision, rather than configure a specific screen.
AAA and identity sources
- Identification is the claimed identity, such as a username or certificate subject. Authentication proves it. Authorization decides what the identity may do. Accounting records what happened.
- FortiAuthenticator can authenticate local users, remote LDAP/Active Directory users, RADIUS clients, and certificate holders. Remote directories remain the source of truth for AD accounts; FortiAuthenticator does not replace AD just because it caches or maps groups.
- A FortiAuthenticator user group can be local or mapped to a remote directory group. Group membership is the usual bridge from authentication to authorization on FortiGate.
- MFA requires two different factor types: knowledge (password), possession (FortiToken, certificate), or inherence (biometric). Two passwords are not MFA.
SSO and federation
SSO means one authentication event grants access to multiple resources. Federation extends this across trust boundaries using a standard such as SAML: the identity provider authenticates and issues an assertion; the service provider trusts the assertion and authorizes locally. Federation is not the same as a shared local user database.
Worked example
A FortiGate SSL VPN uses FortiAuthenticator as its RADIUS server. An AD user enters an AD password plus a FortiToken OTP. FortiAuthenticator receives the RADIUS request, binds to AD to verify the password, validates the OTP, and returns Accept with a Fortinet group attribute. FortiGate matches that group in an SSL VPN or firewall policy. Reasoning: authentication is split between AD for the password and FortiAuthenticator for the OTP, while authorization is enforced by FortiGate policy, not by the RADIUS Accept alone.
Traps that cost marks
- Treating an LDAP bind as authorization; a successful bind only proves credentials.
- Assuming nested AD groups are automatically expanded into FortiAuthenticator groups; mapping must match what the directory exposes.
- Calling password plus security question MFA when both are knowledge factors.
- Confusing federation, which relies on trusted assertions, with a single sign-on session inside one domain.