The log message "Authentication failed, user not found" is generated even though the user account exists on the FortiAuthenticator. This specific error indicates that the user lookup process for the RADIUS service failed. This occurs when the user account, while present in the system, does not have the Allow RADIUS authentication option enabled. The FortiAuthenticator's RADIUS service queries for users who are explicitly permitted to use it; if the flag is not set for the user jdoe, the service considers the user "not found" for the purpose of this authentication request.

A. An incorrect source IP from the Network Access Server (NAS) would result in a log message such as "Unknown NAS" or "Invalid client", not a user-related error.

B. A missing client entry for the AP is the same issue as an incorrect NAS IP, which would generate a client-related error, not "user not found".

C. An incorrect RADIUS secret would cause the initial packet decryption to fail, leading to a log message like "Invalid authenticator" or "Bad authenticator", which occurs before the user lookup stage.

1. Fortinet Knowledge Base

Technical Tip: FortiAuthenticator RADIUS debug - 'user not found' (Article ID: FD46111): This article directly addresses the scenario. It states

"This error message can be misleading. It does not necessarily mean that the user does not exist in the FortiAuthenticator database. It can also mean that the user is not allowed to authenticate using RADIUS. To solve this issue

edit the user under Authentication > User Management > Local Users and ensure that 'Allow RADIUS authentication' is enabled."

2. FortiAuthenticator 6.4.0 Administration Guide

Page 161 (Troubleshooting Section): In the troubleshooting guide for RADIUS authentication

it explicitly notes: "If the log message reads 'user not found' but you know the user exists

check that RADIUS authentication is enabled for that user (Authentication > User Management > Local Users)."

3. FortiAuthenticator 6.5.0 Administration Guide

Page 61 (Local Users Section): When creating or editing a local user under Authentication > User Management > Local Users

the "Allow RADIUS authentication" toggle is a required setting for the user to be able to authenticate via the RADIUS service. If disabled

the user is ineligible for RADIUS authentication.