Troubleshooting Tip: Resolving issues with an LDAP authentication remote admin account profile assigned incorrectly

Description

This article describes the steps to resolve an account authorization issue with LDAP authentication on FortiWeb, where the LDAP account login does not allocate to the correct Group Profile. The user may experience issues with account authorization due to incorrect configuration settings.

Scope

FortiWeb.

Solution

Scenario:

1. FortiWeb has multiple remote administrators created with LDAP authentication.

2. The remote administrators use the same LDAP authentication server.

3. Each remote administrator account is supposed to be assigned to different admin profiles to have specific FortiWeb admin account roles assigned. 

4. In this scenario, both remote administrators are enabled with the 'wildcard' option.

5. When logging in to the FortiWeb using the account 'fwbuser01', the account role should be in the read-only role, but the account appears to have write access (full privileges). The account 'fwbuser01' has been assigned with the admin profile 'prof_admin' due to the account login matching the wildcard LDAP authentication of 'fwbadmin01'.

6. The event log shows that the 'fwbuser01' logged in but matched the admin account 'fwbadmin01'.

 
Resolution:

1. To resolve the issue where the incorrect admin profile is assigned to the remote LDAP auth admin account, disable the wildcard option for the LDAP account.

2. Log into the FortiWeb again using the remote LDAP admin account 'fwbuser01' with the wildcard option disabled. The LDAP authentication account should match exactly to the created remote admin account in FortiWeb.

3. The access profile is now restricted to the read-only profile as assigned in the admin profile.

Related document:

Grouping remote authentication queries and certificates for administrators