Agentless FSSO login via LDAP

Question

I' m using 5.03 on a 100D. I' ve set up my LDAP server, which test successfully using the test button and I can authenticate the admin user used to create the LDAP login.    I then create two AD groups. One for all access to the internet one with filtered access.     I create two firewall groups (as directed by support) with the respective groups specified via cn. My AD groups do not show up in the Forti OS anywhere as to just add them as an FSSO group.    I am unable to get anything to authenticate via LDAP. When I use the diagnose dbug authd fsso list command, I get the following:    ----FSSO logons----  Total number of logons listed; 0, filtered: 0  ----end of FSSO logons-----    I am new to this, but I can read. But the documentation seems all over the place and opposite of what support has directed...now I get no response...    Can anyone give me any indication of wth I' m doing?

pello · Accepted Answer

Hi,    Agentless FSSO login does not rely on LDAP for authentication.  LDAP is used for authorization and to know which group the user will be mapped.    First, configure the LDAP server which seems OK for you.  Second, create the agentless FSSO profile and choose the LDAP server you created just before.  Groups must be automatically populated from the FSSO agentless declaration page within the view/edit groups.    Once you got them, perform the user group association in the user > group menu.  Final configuration step, create the identity-based policy.    To troubleshoot,  In 5.0 with agentless FSSO, the correct CLI commands are:    diag debug fsso-polling user  diag debug fsso-polling detail       First thing is to be sure the Fortigate receive the logon information from the domain controllers:    diag deb app authd -1  diag deb app fssod -1  diag deb app smbcd -1  diag deb enable    // Generate a logon    Diag debug should include logon event related to the user that just logged-in. If you don' t see them, start checking that the account used to reach the domain controller is part of domain admin group (or at least is a member of the event log readers group if win2k8) and that Fortigate can reach the domain controller through tcp port 445. In any case, the previous diag commands should help to go forward.    Cheers

irrational · Answer

Ok. Thanks for the information.   When I try the polling commands, I get a " fsso daemon is not running"  result.  How would one " start"  the fsso daemon?

Sign up

Login with SSO

Login to the community

Login with SSO