Skip to main content
ephemeric
ephemeric
New Member
September 5, 2018
Solved

Admin PKI 2FA Login

  • September 5, 2018
  • 1 reply
  • 10329 views

Hi,

 

We have created PKI users: robert, dhyata and rivaan with 2FA enabled.

We have created Administrators: robert_pki, dhyata_pki and rivaan_pki of type "Use public key infrastructure (PKI) group".

All PKI users are members of PKI group.

 

When I login (robert_pki), the browser asks to select cert and the login dialogue box is presented with the "User Name" field filled in with "robert_pki". I enter my 2FA password and login. That's all good.

 

However, when another user trys to login, using their cert in their browser, their login dialogue box when presented, already has "robert_pki" as "User name" filled in and greyed out and hence 2FA does not work for them.

 

If I delete robert_pki and login with 2FA dhyata_pki, it works. I create robert_pki and proceed to login with myself and see "dhyata_pki" as "User name" filled in and greyed out and hence 2FA does not work.

 

Tried from different workstations and hence different browsers.

 

I'm stumped.

Please help.

 

FortiOS 5.4.4 build 6003 (GA) on a FortiGate 101E.

 

Thank you.

 

 

    Best answer by emnoc

    It could be, I play around with this on  numerous browsers and   even in FML and the browsers all cache items differently. If you want to PoC use "curl" and simple web-auth and avoid the browser-types.

     

    This might help also ; http://socpuppet.blogspot.com/2017/06/mfa-using-certficates-fortios-sys-admin.html

     

    and

    http://socpuppet.blogspot.com/2018/05/how-to-check-client-certificate-tls.html

     

    FWIW: I have a FGT60D on 5.4.56 and do not see any problems   using  Safari or Firefox ( i'm a mac user btw ). So if you have access to  5.4.6, upgrade and restest. V6.0 also works perfectly  btw

     

    Ken

    1 reply

    tanr
    tanr
    New Member
    September 5, 2018

    I'm not sure if the PKI group setup could be part of the problem, but there was at least one rather bad bug in 5.4.4 (Bug ID: 412987) related to how the certificates were looked at by the FortiGate.  See https://forum.fortinet.com/tm.aspx?m=142712 for a discussion of it.

     

    That bug was fixed in 5.4.5, so you might want to try 5.4.5, or move up to the more recent 5.4.9 or 5.4.10.

    emnoc
    emnoc
    New Member
    September 5, 2018

    I just did a write up on this 

     

    http://socpuppet.blogspot.com/2018/05/securing-fortigate-https-admin-with-pki.html

     

     

    what I  have  observed over a few years now; " The client web-browser type" plays a lot in the behavior for Certificate   and PKI for the admin interface. Have you tried MSIE, CHROME  , Safari and FF

    tanr
    tanr
    New Member
    September 5, 2018

    Hi Ken, nice write up. 

     

    It looks like from your example the user name, CN on the certificate, and CN set in the PKI object all need to match?  The bug 412987 with 5.4.4 I ran into involved some cases where the FortiGate was not correctly matching the CN of the cert with the PKI -- don't know if that could be part of this issue or not.

    Terms & ConditionsAccessibility statement