Troubleshooting Tip: 'No DN is Found' error during LDAP authentication failure for usernames with domain names in FortiGate

Navigate to the LDAP settings via FortiGate CLI to understand the current configuration by using commands:

config user ldap
    edit <LDAP Server Name>

show

Run the following debug commands to check for the error 'No DN is Found'.

diagnose debug enable
diagnose debug application fnbamd 255

diagnose debug enable

To stop the debug, run the following commands:

diagnose debug disable

diagnose debug reset

If debug logs show 'No DN is found', this output will appear:

[1100] fnbamd_ldap_recv-Response length: 16, server: 192.168.1.11
[988] fnbamd_ldap_parse_response-Received one MESSAGE. ID: 2, type: search-result
[1008] fnbamd_ldap_parse_response-Return code: 0
[1335] __fnbamd_ldap_dn_next-No DN is found.             -> Issue.
[1055] __ldap_rxtx-Changed state to 'Done'

Set the CNID attribute to 'UserPrincipalName' to allow successful authentication using usernames with domain names.

Here are the commands to run on the CLI:

config user ldap

    edit <LDAP Server Name>
        set cnid "UserPrincipalName"

end

Note:

1. Only 'UserPrincipalName' would work for 'username@domain.local', while sAMAccountName and cn are suitable for 'username' and 'domain\username'.
2. In cases where the error messages 'No DN is found' and 'Error 49 (80090308: LdapErr: DSID-0C0905BB, comment: AcceptSecurityContext error, data 52e, v65f4)' appear in the debug logs same time, it may indicate an authentication issue. If the user prefers to use the UserPrincipalName (UPN) as the CNID, the user must log in using the 'username@domain.local' format when connecting to the VPN. It is also essential to ensure that the username is correctly bound to the corresponding domain in the Active Directory (AD) server. Failure to do so may result in a 'permission denied' error during authentication.

3. 'cn' is the default, and most of the customers will be using 'sAMAccountName'. 'cn' refers to 'Common Name', which is the 'Display name', and 'sAMAccountName' is the logon name (about Windows LDAP server).

Related articles:

Troubleshooting Tip: FortiGate LDAP troubleshooting and debug logs created by fnbamd