Technical Tip: How to create administrators which can be authenticated by a LDAP Server
Description
This article describes how to create FortiGate admin users which can be authenticated by a LDAP server.
Scope
Access FortiGate WebGUI using LDAP users
Solution
Configuration Method:
To use an LDAP server to authenticate administrators in a VDOM, the authentication has to be configured before the administrator accounts are created.
- Configure an LDAP server
For example:
edit "ldap"
set server "10.40.9.78"
set cnid "sAMAccountName"
set dn "dc=dubailab,dc=lab"
set type regular
set username "cn=administrator,cn=users,dc=dubailab,dc=lab"
set password p@ssword
end
If only a particular group of members are to be allowed to log in to FortiGate as administrators, a FortiGate group must be configured to limit access.
- Create an LDAP user group on Active Directory and FortiGate.
Right-click the new group, select 'Properties' and add users that will authenticate:
Create group on Fortigate:
config user group
edit "salesgrp"
set group-type firewall
set authtimeout 0
set auth-concurrent-override disable
set http-digest-realm ''
set member "ldap"
config match
edit 1
set server-name "ldap"
set group-name "CN=salesgrp,CN=Users,DC=dubailab,DC=lab"
next
end
next
end
- Configure an administrator to authenticate with an LDAP server.
edit "ldap_admin"
set remote-auth enable
set accprofile "prof_admin"
set vdom "root"
set wildcard enable
set remote-group "salesgrp"
next
end
The remainder of the parameters have to be left with the default values.
Note:
