FortiClient SSO Mobility Agent

The FortiClient SSO Mobility Agent is a feature of FortiClient Endpoint Security. The agent automatically provides user name and IP address information to the FortiAuthenticator unit for transparent authentication. IP address changes, such as those due to WiFi roaming, are automatically sent to the FortiAuthenticator. When the user logs off or otherwise disconnects from the network, the FortiAuthenticator unit is aware of this and deauthenticates the user.

The FortiClient SSO Mobility Agent Service must be enabled. See Enable FortiClient SSO Mobility Agent Service on page 108.

For information on configuring FortiClient, see the FortiClient Administration Guide for your device.

Fake client protection

Some attacks are based on a user authenticating to an unauthorized AD server in order to spoof a legitimate user logon through the FortiClient SSO Mobility Agent. You can prevent this type of attack by enabling NTLM authentication (see Enable NTLM on page 108).

The FortiAuthenticator unit will initiate NTLM authentication with the client, proxying the communications only to the legitimate AD servers it is configured to use.

If NTLM is enabled, the FortiAuthenticator unit requires NTLM authentication when:

l the user logs on to a workstation for the first time, l the user logs off and then logs on again, l the workstation IP address changes, l the workstation user changes, l NTLM authentication expires (user configurable).