What FortiAuthenticator does: multi-factor authentication, SAML federation, FSSO, certificates and 802.1X, along with deployment best practices.
FortiAuthenticator is Fortinet's solution for centralising the authentication of users and devices: multi-factor authentication, RADIUS and LDAP server, SAML identity provider, certificate authority and transparent user identification on the network. It serves as a single control point between your directories, your network devices and your applications. Here is what it does, how it integrates with the rest of your environment, and what you should watch out for during a deployment.
In most organisations, identities are stored in a directory, often Active Directory. Devices and applications each need to verify these identities: the firewall for the VPN, Wi-Fi access points, switches, administrative access to devices, web applications. Without a central point, each system is connected separately to the directory, with its own rules and without consistent strong authentication.
FortiAuthenticator sits between these two worlds and connects them. It relies on the existing directory (or on its own user database), adds the additional authentication factors, and responds to requests from devices and applications using the protocols they understand. According to the vendor's product datasheet, it is available as a physical appliance, as a virtual machine for the main hypervisors, and as a cloud service. The 8.0 branch is the major version documented in 2026.
Multi-factor authentication is often the first reason why an organisation decides on a deployment. FortiAuthenticator supports:
In addition, it also offers adaptive authentication, which adjusts requirements based on the login context (user, device, location, IP address). Where possible, favour FIDO2 for sensitive accounts, as this method resists phishing sites that relay one-time passcodes.
The wide range of supported protocols makes it possible to cover both legacy devices and modern applications:
Fortinet Single Sign-On (FSSO) is another key feature: FortiAuthenticator collects user logon events (domain controllers, portals, RADIUS accounting, etc.) and sends FortiGate the mapping between IP address and identity. The firewall can then apply policies per user or per group, without users having to enter their credentials again.
FortiAuthenticator includes a certificate authority that manages the lifecycle of X.509 certificates: issuance, renewal and revocation, as well as the SCEP and CMP enrolment protocols. These certificates are used to authenticate users and machines, particularly with 802.1X on wired and Wi-Fi networks, where only devices with a valid certificate are allowed.
FortiAuthenticator can also manage captive portals for guest users, with temporary accounts and self-registration.
A few points deserve particular attention during the project:
FortiAuthenticator is generally deployed alongside a FortiGate, for the VPN, FSSO and per-user policies. The FortiGate Administrator certification preparation covers these mechanisms on the firewall side. For identity management, federation and conditional access concepts in a Microsoft environment, Microsoft SC-300 is a useful complement. Managers who define the access policy will find the overall framework for identity management in ISC2 CISSP.
FortiAuthenticator centralises strong authentication, identity federation, certificates and user identification on the network. When properly deployed, in high availability and with authentication methods matched to the risks, it becomes the foundation for consistent access control across the VPN, Wi-Fi, administration and applications.