Technical Tip: Entry not found error when trying to add remote LDAP server to authentication scheme on FortiGate

Description

This article describes an 'Entry not found' error when trying to add a remote LDAP server to an authentication scheme on a FortiGate.

Scope

FortiGate.

Solution

When using an authentication scheme and authentication rule with an LDAP server, an 'Entry not found' error may appear when applying the configuration.

This is due to the LDAP configuration, where the attribute group-member-check is set to group-object, and the member-attr field is also set.

LAB-DEV (FortiGate TEST) # show
config user ldap
    edit "FortiGate TEST"
        set server "ips.fortinet.net"
        set cnid "uid"
        set dn "cn=users,cn=accounts,dc=local"
        set type regular
        set username "sdwd"
        set password ENC acytnPXBScmMoihctkwhfUvt+yiBebOKos2kQoQD9rJvzy5RVheu+Rl/ZXMhnxSHs4XfA5UO/LoUizQjpzJUNUHoxjTTZx3hjX0pKcja7xTWsKKUTtHPRLca0JhsTxVFho1bJGlb1TRH+itaL/zEayo/aTPZDngDvDKBz2SSx9IVsQhQx8VFVklTyPQ8HEa9RmHYellmMjY3dkVA
        set group-member-check group-object
        set secure ldaps
        set port 636
        set member-attr "memberof"
    next
end

Solution:

FortiGate blocks or fails to select an LDAP server when mixing member of attributes with Object ID-based group matching due to a conflict between user-attribute and group-object evaluation schemes.

To resolve this issue, unset group-member-check and member-attr to the default config.

LAB-DEV (root) # config user ldap 

LAB-DEV (ldap) # edit "FortiGate TEST"

LAB-DEV (FortiGate TEST) # unset group-member-check 

LAB-DEV (FortiGate TEST) # unset member-attr 

LAB-DEV (FortiGate TEST) # end

LAB-DEV (root) # 

Now the LDAP server can be used for authentication, and an authentication rule can be created on the firewall.

Related article:

Technical Tip: LDAP user authentication using Member Attribute match