Azure AD, Fortinet Filtering

[RLR]

If you did use my Install.ps1 script you might want to update it to the newer one. I noticed by default that the script doesn't run unless the device is plugged into AC so I've added a couple of things to the Install script:

 

$settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries

 

Register-ScheduledTask -TaskName $ScheduledTaskName -Trigger $Time,$onUnlockTrigger -Action $Action -Force -Principal $STPrin -Settings $settings

 

Edit: I also moved over to using the Invoke-WebRequest method as it seems to be a lot smoother than forcing edge to open and then sending a ctrl+w to the device.

Edited June 12, 2024 by RLR

[jslate1980]

We are now using forticlient with ssoma, through fortiauthenticator server. It’s working well.

[Mr_Jiminy]

We are now using forticlient with ssoma, through fortiauthenticator server. It’s working well.

 

But given the cost of Fortiautenticator, this is out of the realms of possibility for a smaller school.

[jslate1980]

But given the cost of Fortiautenticator, this is out of the realms of possibility for a smaller school.

 

You are right.

[RLR]

But given the cost of Fortiautenticator, this is out of the realms of possibility for a smaller school.

 

This was our issue. Something that was free before (agent installation on DC) now costs £5k. Might have to budget it for next year but for now our Seamless SSO is working okay.

[RobFuller]

This really got me angry when I was trying to resolve authentication issue with our Fortinet setup. It was only a tiny bit more expensive to buy into a cloud filtering solution compared to the licensing costs, so we did. Made no sense for us to go authenticator route frustratingly.

[Mr_Jiminy]

This was our issue. Something that was free before (agent installation on DC) now costs £5k. Might have to budget it for next year but for now our Seamless SSO is working okay.

 

Are you experiencing any other weird issues?

We're set-up the same was as you, we actually use a log off script to force end the user session on log out. But, we're seeing lots of weird issues with browser cache, whereby users are frequently having to clear browser cache.

[RLR]

Are you experiencing any other weird issues?

We're set-up the same was as you, we actually use a log off script to force end the user session on log out. But, we're seeing lots of weird issues with browser cache, whereby users are frequently having to clear browser cache.

 

I haven't come accross anything yet but it's not running on all our devices at the moment. We have a scheduled task setup to run at each new user login to visit the logout URL. Seems to be working okay but not been using it very long.

[Manny-Tech]

I'm finding that once users are logged in they can use 'Open browser and connect' which probes the Microsoft captive portal check site and then proceeds to do the Azure auth. However, if staff do not click that link at the side of the WiFi properties and open a browser they get a 'Wifi may require you to go to its sign-in page' rather than directing me there. Having looked into it, I think it's when a https:// site is specified as a homepage. If I go to http://neverssl.com, it redirects to a captive portal through Azure, and they are signed in. 

 

Not sure there is a solution to this other than telling staff to either click 'Open browser and connect' or browse to a http site first.