FAC - remote user synch w/ AD not pulling cert bindings for users

Hello @doncacciatoconsuting 

You can follow below steps to check for any misconfiguration:

1. Verify Certificate Binding Configuration:
- Check the LDAP User Mapping Attributes in the remote user sync rule on FAC. Ensure that the Certificate binding common name is correctly set to dNSHostName.

2. Check Certificate Issuance:
- Validate that the user's certificate is correctly issued by the Certificate Authority (CA) and is valid.
- Ensure that the user's certificate includes the necessary attributes for binding, such as dNSHostName.

3. Review LDAP Configuration:
- Double-check the LDAP filter in the remote user sync rule to ensure it includes the necessary criteria to match the user with the certificate.
- Verify the LDAP settings on FAC to ensure proper connectivity and synchronization with Active Directory.

4. Test and Troubleshoot:
- Run a manual sync on the remote user sync rule to force the update and import of the user's information.
- Monitor the FAC logs for any errors or warnings related to the certificate binding process.

5. Collaboration with Domain Controller Team:
- Coordinate with your domain controller team to confirm the presence and correctness of the user's certificate attributes in Active Directory.
- Request assistance in checking the certificate issuance process and ensuring the necessary attributes are included.

For reference:

https://docs.fortinet.com/document/fortiauthenticator/6.6.0/examples/606570/importing-users-with-a-remote-user-sync-rule

https://docs.fortinet.com/document/fortiauthenticator/6.6.1/release-notes/713049/known-issues#Known_issues

https://docs.fortinet.com/document/fortiauthenticator/6.6.0/administration-guide/215969/remote-user-sync-rules

https://docs.fortinet.com/document/fortiauthenticator/6.6.0/examples/863753/configuring-the-eap-server-certificate

https://docs.fortinet.com/document/fortiauthenticator/6.6.1/administration-guide/987701/remote-user-sync-rules-ldap

With certificate binding in LDAP remote user sync for RADIUS/EAP-TLS authentication with Active Directory, follow these steps:

1. Verify that the Certificate binding common name in LDAP User Mapping Attributes is set to "dNSHostName" and matches the user's certificate CN attribute.

2. Ensure the LDAP filter correctly includes users with certificates.

3. Confirm the correct Certificate Authority (CA) is selected in the Certificate binding CA dropdown.

4. Run the user sync rule and check for errors or warnings.

5. Verify the user and certificate binding in FortiAuthenticator under Authentication > User Management > Remote Users.

6. Ensure the user's certificate is valid, not expired, and properly signed. These steps will help ensure proper certificate binding and user synchronization in FortiAuthenticator.

Thanks all, I'm quite new to using the Domain Controller Cert service. 

Item #1 - I have dNSHostName set in the config. My user cert has these fields...CN=John Doe CN=Users DC=mydomain DC=com. I don't see "dNSHostName"

#2 - I am not using an LDAP filter at this point because I'm not quite sure how to configure it. I assume that no filter = ALL, right ?

#3 - CA is all good

#4 No warnings/error when I run the synch rule manually or on schedule

#5 This field is empty - so I added it manually and that seems to work

#6 - user cert is def good

The interesting thing is that I have a computer account that was synch'd and the proper cert binding was pulled.

ANy other ideas ?

I'm not even so sure this matters, because my user still gets authenticated successfully..I'm using the Radius Policy of Trusted CAs rather than the Certificate Bindings. Does that make sense ?