Technical Tip: How to setup FortiGate to use custom LDAP attribute from which to get group membership
Description
In some environments, the LDAP group memberships are defined in a custom LDAP attribute (not in the default memberOf).
This article describes how to set the FortiGate up for such cases and how to create and apply user group in the firewall policy via CLI.
Solution
The LDAP server attribute <custom_attribute> hold group <ldap_group_name>.
Setting up LDAP configuration:
In some environments, the LDAP group memberships are defined in a custom LDAP attribute (not in the default memberOf).
This article describes how to set the FortiGate up for such cases and how to create and apply user group in the firewall policy via CLI.
Solution
The LDAP server attribute <custom_attribute> hold group <ldap_group_name>.
Setting up LDAP configuration:
#config user ldapCreating a user group:
edit <ldap_name>
set group-member-check user-attr
set member-attr <custom_attribute>
end
#config user groupApplying the group in the IPv4 firewall policy:
edit <group_name>
set member <ldap_name>
config match
edit 1
set server-name <ldap_name>
set group-name <ldap_group_name>
end
end
#config firewall policy
edit <policy_ID>
set groups <group_name>
end
Related Articles
