Technical Tip: Importing LDAP user and applying two factor email Token
Description
This article describes how to import the LDAP users in FortiGate and apply two-factor email Token via CLI.
Scope
FortiGate.
Solution
Import the user to the FortiGate from GUI.
To import users from LDAP follow these steps:
- Go to User & Devices -> User Definition and select 'Create New'.
- On 'User Type', select 'Remote LDAP user' and select 'Next'.
- On 'LDAP Server', Select the LDAP server name and select 'Next'.
- Select the User, select '+ Add Selected ' and select 'Submit'.
Once the user is imported, it is possible to enable two-factor email Token via the CLI:
config user local
edit TestUser
set two-factor email
set email-to "example@example.com"
set ldap-server "LdapName"
edit TestUser
set two-factor email
set email-to "example@example.com"
set ldap-server "LdapName"
end
To avoid users authenticating against LDAP directly and bypass two factor email-token, use the command 'set username-sensitivity disable' under user settings. Refer to Technical Tip: Description of CVE-2020-12812 (bypassing two-factor authentication for LDAP users) and remediation options for more information.
To avoid users authenticating against LDAP directly and bypass two factor email-token, use the command 'set username-sensitivity disable' under user settings. Refer to Technical Tip: Description of CVE-2020-12812 (bypassing two-factor authentication for LDAP users) and remediation options for more information.
