Technical Tip: User information from user login ID by LDAP connectors
Description
This collects additional information about authenticated FSSO users, and display from GUI.
- FortiView -> Sources.
- FortiView -> Policies.
- Log & Report -> Forward Traffic.
- User & Device -> Device Inventory.
Scope
For version 6.2.1.
Solution
This requires that FSSO is configured on the FortiGate.
To view the user information on pages other than Firewall monitor, 'Device Detection' has to be enabled on the interface.
The user-info-server variable in user FSSO configuration is used to select the LDAP server that is used for retrieving user information.
After a valid FSSO user is authenticated, the FortiGate will try to get additional user information from the LDAP server.
To configure the user.
1) Configure the LDAP user.
This collects additional information about authenticated FSSO users, and display from GUI.
- FortiView -> Sources.
- FortiView -> Policies.
- Log & Report -> Forward Traffic.
- User & Device -> Device Inventory.
Scope
For version 6.2.1.
Solution
This requires that FSSO is configured on the FortiGate.
To view the user information on pages other than Firewall monitor, 'Device Detection' has to be enabled on the interface.
The user-info-server variable in user FSSO configuration is used to select the LDAP server that is used for retrieving user information.
After a valid FSSO user is authenticated, the FortiGate will try to get additional user information from the LDAP server.
To configure the user.
1) Configure the LDAP user.
# config user ldap2) Configure the FSSO user.
edit "AD-LDAP"
set server "10.1.100.131"
set server-identity-check disable
set cnid "cn"
set dn "dc=fortinet-fsso,dc=com"
set type regular
set username "cn=Administrator,cn=users,dc=fortinet-fsso,dc=com"
set password ENC
MTAwNIJ4Fk+smJ/CVOuEG2Pjphc5nzumAuRTGjEWiWny1qOB3UYLgYJovcNg1lLkXIFKf9Ov rYNSrt4gfdchKGsLbQbruvHxE1MeEdcw+G7IpNsgUWX1Dlc0uwEKsBuZMGptI5scsEzG1Lqe6H2 J9F9Dok2cqwEX8MCYmStlDc9z11Rl30KkwCdn6wzCS3t+Xq+DPg==
set secure ldaps
set ca-cert "CA_Cert_1"
set port 636
next
end
# config user fssoTo verify that information is being collected per user.
edit "ad-214"
set server "10.1.100.142"
set password ENC
JvwNFvjbXd7T0qsYkO18K8k+DZlHFwDvc7CAv6gHD1nvE7nu8tlaQrWf/tK5o0jDChqkUUG7Wm yqeGupJmTFYzDTB4szvVUafR4D0BKVCt8AaULybjoAtJb6NvU2Hu7P0Trnh08p930hleR13r4mB HjLmNEyBZgvB6jz7bOZYtKaQdkCn/9KKrjAteVjWqxcqYCEvw==
set user-info-server "AD-LDAP"
next
end
# diagnose wad user info 20 TEST1
'username' = 'TEST1'
'sourceip' = '10.1.100.188'
'sourceip' = '32.1.0.0'
'sourceip' = '10.1.100.185'
'vdom' = 'root'
'cn' = 'test1'
'givenName' = 'test1'
'sn' = 'test101'
'userPrincipalName' = 'test1@Fortinet-FSSO.COM'
'telephoneNumber' = '604-123456'
'mail' = 'test1@fortinet-fsso.com'
'thumbnailPhoto' = '/tmp/wad/user_info/ff1bffff376dff29ffff24ff65ff42ffff09292d'
'company' = 'Fortinet'
'department' = 'Release QA'
'memberOf' = 'CN=group321,OU=Testing,DC=Fortinet-FSSO,DC=COM'
'memberOf' = 'CN=g1,OU=Testing,DC=Fortinet-FSSO,DC=COM'
'memberOf' = 'CN=group21,OU=Testing,DC=Fortinet-FSSO,DC=COM'
'memberOf' = 'CN=group1,OU=Testing,DC=Fortinet-FSSO,DC=COM'
'manager' = 'CN=test6,OU=Testing,DC=Fortinet-FSSO,DC=COM'
'streetAddress' = 'One Backend Street 1901'
'l' = 'Burnaby'
'st' = 'BC'
'postalCode' = '4711'
'co' = 'Canada'
'accountExpires' = '9223372036854775807'
total 1, count 1
