Description | This article describes how to integrate an LDAP directory on Windows Server and FortiDLP Console via encrypted communication. The FortiDLP LDAP Sync Tool synchronizes users between the LDAP directory and the FortiDLP Infrastructure. In this article, the LDAP Sync Tool is executed on the Active Directory (AD) server. The prerequisite to configure LDAP user synchronization can be found in the FortiDLP LDAP Sync Tool Administration Guide. The AD server must be configured to accept TLS/SSL connections to ensure user synchronization is encrypted via TLS. If LDAPS is not yet enabled on the AD server, follow steps 1–4 to enable it on a Windows Server Domain Controller. If LDAPS is already enabled, skip to step 5 for best practices on configuring the LDAP Sync Tool for a Windows AD server.
To verify the above, connect to the AD server via LDAPS (port 636) using the correct bind, binddn, and password values. This can be done using any LDAP tool. |
Solution | Step 1. Install the Active Directory Certificate Services Role Open Server Manager and choose Add Roles and Features.
On the 'Before You Begin' page, select Next.
When prompted for the installation type, select Role-based or feature-based installation and proceed with Next.
Under server selection, pick Select a server from the server pool, highlight the AD server, then select Next.
From the roles list, tick Active Directory Certificate Services and select Next.
A window will appear to add required features; select Add Features.
Select through the Features and AD CS information screens using Next.
Under Role Services, check Certification Authority and continue with Next.
Select Install to begin.
After the installation completes, select Configure Active Directory Certificate Services on the Destination Server.
In the configuration wizard, select Next. The current user (a local Administrator) can be used for role configuration.
Select Certification Authority as the role service to configure, then select Next.
Set the setup type to Enterprise CA and proceed.
Choose Root CA and select Next.
Select Create a new private key and proceed.
For the hashing algorithm, choose the most current option available. In this guide, SHA256 is selected. Select Next.
Accept the default CA name and select Next.
Set the certificate validity period as needed, then select Next.
Keep the default database paths and select Next.
Select Configure to apply settings.
Then, select Close once it finishes.
 Â Step 2. Set up a certificate template for LDAPS. Duplicating and configuring the Kerberos Authentication template. Press Windows Key + R, type certtmpl.msc, and press Enter to launch the Certificate Templates Console. Find the Kerberos Authentication template.
'Right-click' it, and choose Duplicate Template.
The Properties of New Template dialog will open. Adjust settings to match the server requirements. On the General tab, enable Publish certificate in Active Directory. Assign the template a name (e.g., in this article, the name of the certificate template is DC0 LDAPS).
On the Request Handling tab, tick Allow private key to be exported.
On the Subject Name tab, set the subject name format to DNS Name, then select Apply and OK.
Section 3. Issue the Certificate Template.
Go to Start -> Certification Authority, 'right-click'Â Certificate Templates, and select New -> Certificate Template to issue.
Choose the template created in the previous step (e.g., DC0 LDAPS) and select OK.
 Step 4. Request a new certificate. Press Windows Key + R and type mmc. Navigate to File -> Add/Remove Snap-in.
Select Certificates and select Add.
Choose Computer account and select Next.
Select Local computer, select Finish, then OK.
Expand Certificates (Local Computer) -> Personal -> Certificates. 'Right-click'Â Certificates and go to All Tasks -> Request New Certificate.
Select Next twice to move through the wizard ('Before You Begin' and Select Certificate Enrollment Policy page).
Select the template from the previous steps and select Enroll.
Once enrolment completes, select Finish.
The certificate will now appear under Certificates (Local Computer) -> Personal -> Certificates.
 Â
Step 5. Creating the configuration file for the Windows AD server. Below is an example of config.yaml file which provides a sample configuration for syncing users from a Windows Active Directory (AD) server to the FortiDLP Console. During the sync, these user attributes are imported - each can be found under ldap-config.sync.schemes in the configuration file: sid. username. email address. unix.
---
# FortiDLP Web UI URL
# Ensure to remove `<` and `>`
apiurl: <FortiDLP Console URL>
# The API token generated from https://region.fortidlp.forticloud.com/#admin/tokens
# Ensure to remove `<` and `>`
apitoken: <FortiDLP Console API access token>
# Disable TLS verification for the connection to FortiDLP Cloud
skiptls: false
# The maximum number of retries that can occur after a failure connecting to
# the Infrastructure or LDAP server, or syncing users.
maxretries: 1
# Whether to include LDAP photos when syncing. User photos are given by the image attribute.
photosync: false
# The configuration details for the LDAP directory to download users from.
ldap-config:
name: adserver
credentials:
addr: adserver.ad.company.uk
port: 636
base: OU=admin,DC=example,DC=com
binddn: OU=admin,DC=example,DC=com
bindpassword: Password123
tlsconfig:
# The TLS encryption method
# 0: Uses TLS
# 1: Uses StartTLS.
method: 0
skipverification: false
# The CA certificate should be in PEM format
# either as a single line, escaped with
for each new line,
# or using YAML | multi-line string formatting with indentation
rootcabundle: |
-----BEGIN CERTIFICATE-----
<PEM contents of certificate>
-----END CERTIFICATE-----
# The optional configuration details for the LDAP directory
sync:
searchterm: "(&(objectCategory=person)(objectClass=user)(objectSid=*))"
keyfields:
name: displayName
email: email
image: thumbnailPhoto
title: title
department: department
manager: manager
phonenumbermobile: mobile
phonenumberoffice: telephoneNumber
addresshome: homePostalAddress
addressoffice: physicalDeliveryOfficeName
schemes:
- scheme: sid
attribute: objectSid
- scheme: username
attribute: sAMAccountName
- scheme: unix
attribute: uidNumber
- scheme: mail
attribute: email
# label mappings to automatically create and assign labels to users based on LDAP properties
labelfields:
- key: department
- key: city
- key: country
- key: memberOf
labelname: Security Group
match: ^CN=([^,]+),OU=Security Groups,DC=example,DC=com
transform: $1
anonymise: false
To complete the setup:
Update the sample configuration file to reflect the server's environment. Once updated, run the following command in the server terminal:
 .\ldap-sync
|
