New Member

Solved

Apple Open Directory

Forum|Forum|10 years ago
March 2, 2016
6 replies
8757 views

Hi,

Im trying to use Open Directory LDAP authentication for VPN logins.

I've set it up for multiple Active Directories and it works great.

But Open Directory does not have a memberOf attribute on user object.

I have found a couple of suggestions on google, but have found nothing that works.

my config is:

config user ldap
   edit ldap_name
      cnid mail
      dn dc=server,dc=domain,dc=local
      type regular
      username uid=username,cn=users,dc=server,dc=domain,dc=local
      password *
      group-member-check group-object
      group-object-filter "(&(objectclass=posixserver)(memberUid=*))"
      member-attr gidNumber
end

If I allow any LDAP group in Group on Fortigate it works.

If I try to specify a group it doesn't match.

I understand that this will not work, since gidNumber on user is only default group.

How can I make fortigate search group objects for user members?

LDAP

Best answer by Fishbone_FTNT

Hi Torgnyw,

maybe you group-object filter or member-attr is not correct.

"(&(objectclass=posixserver)(memberUid=*))" -> check if group object is "posixserver" and it does have users listed using "memberUid".

also member-attr change to attribute which lists users in the group object.

For example, my lab OpenLDAP does have it like this:

group-object-filter "(&(objectclass=groupOfUniqueNames)(uniqueMember=*))" member-attr "uniqueMember"

My 2c,

Fishbone )(

emnoc

New Member

Do know if this helps but you can specify groups under the config user group and use that in your ssl policies.

config user group edit "CA_Users_NA" next edit "GROUPAD1" set member "LDAPGRP1" config match edit 1 set server-name "LDAPGRP1" set group-name "CN=SSLVPNCAN,CN=Users,DC=1plus1eq2,DC=com" next end next end

Could you do it that way and use the group for the sslvpn policy?

Fishbone_FTNTAnswer

Staff

Hi Torgnyw,

maybe you group-object filter or member-attr is not correct.

"(&(objectclass=posixserver)(memberUid=*))" -> check if group object is "posixserver" and it does have users listed using "memberUid".

also member-attr change to attribute which lists users in the group object.

For example, my lab OpenLDAP does have it like this:

group-object-filter "(&(objectclass=groupOfUniqueNames)(uniqueMember=*))" member-attr "uniqueMember"

My 2c,

Fishbone )(

torgnywAuthor

New Member

Thanks for answer Fishbone_FTNT.

I've now have it working, but only if I use uid as cnid.

It will then browse all groups matching filter, and look for member-attr field (memberUid).

There the uid of the user is listed, and validated.

If i use mail field as cnid, is there anyway to get it to still match group membership based on uid?

I have multiple companies logging in to this firewall, and would like to use email as username to make a clear distinction on what company they are logging in to.

\\

Torgny

Sign up

Login with SSO

Login to the community

Login with SSO