Technical Tip: Step-by-Step creating Keytab file for FortiNAC Winbind integration

Description

This article explains the steps needed to create a Keytab file and upload it to FortiNAC for successful Winbind integration using Kerberos authentication.

Scope

FortiNAC-F, Active Directory.

Solution

1. Create a user with the same name as FortiNAC hostname. Clone the Administrator account:

2. Create the user account:

• sAMAccountName: nacsrv

• First name: nacsrv

• Last name: leave it blank
  

When creating this account, select the following:

• User cannot change password.

• Password never expires.

3. Open the command prompt as administrator. The realm must be in capital letters.

> ktpass /princ HTTP/service account@REALM /mapuser service account-pass <password> /out <any-keytab-name>.keytab /crypto AES256-SHA1 /ptype KRB5_NT_PRINCIPAL

> ktpass /princ HTTP/nacsrv.forti.test@FORTI.TEST /mapuser nacsrv -pass <password> /out testhttp.keytab /crypto AES256-SHA1 /ptype KRB5_NT_PRINCIPAL

See below for an illustration - make sure no errors are presented:

4. After running the above command, the user account will automatically be modified in the Attribute Editor:

Upon reviewing the Attribute Editor tab, the following servicePrincipalName entries are associated with the account.

4. Also, the userPrincipleName is automatically updated:

5. Next, go to FortiNAC under Network -> RADIUS -> Winbind.
   Fill the user name with HTTP/nacsrv.forti.test (the servicePN account should be used).

6. After FortiNAC is joined to the domain, a Computer account should automatically be created in the Computers container.

7. Checking the keytab content via FortiNAC CLI:

fortinac729# execute enter-shell

fortinac729:~$ klist -kte /etc/samba/krb5.keytab

Keytab name: FILE:/etc/samba/krb5.keytab
KVNO Timestamp         Principal
---- ----------------- --------------------------------------------------------
   3 01/01/70 01:00:00 HTTP/nacsrv.forti.test@FORTI.TEST (aes256-cts-hmac-sha1-96)

Additional note:

• When creating a keytab, it targets the existing domain where the ktpass command ran. To create a keytab file for several domain controllers (DCs), first generate individual keytabs for each DC using the Microsoft Learn ktpass command, and then merge them.

• Verify that the domain controller and FortiNAC are running on the same NTP server to ensure time synchronization (Time draft should not be more than 5 minutes).

• Check the DNS settings on FortiNAC to ensure that the primary and secondary DNS servers are correctly configured.

• If the keytab is not generated on the secondary domain, the authentication will failback to NTLM.