Skip to main content
Tindrli
Tindrli
New Member
July 10, 2018
Question

Fortigate 100E and LDAP security groups issue

  • July 10, 2018
  • 1 reply
  • 6886 views

Hi,

 

I have Fortigate 100E with FortiOS 5.6.4 and I'm having a problem with using security groups in LDAP. I configured LDAP on my FGT and test went OK. If i create a policy with a single user than that policy works, but if I add that user to a group and then create a policy with a group then it's no go. I've found online quite a few questions about this problem but no answer.

Can someone give me an idea what to look for or how to make this work?

 

 

 

    1 reply

    xsilver_FTNT
    Staff
    xsilver_FTNT
    Staff
    July 17, 2018

    Hi,

    made it working in lab test with no issues on 'Version: FortiGate-VM64 v5.6.4,build1575,180425 (GA)' ...

     

    config user local

    edit "usera" set type ldap set ldap-server "C24_ALFA.XSILVER.ORG" next edit "userb" set type ldap set ldap-server "C24_ALFA.XSILVER.ORG" next end

     

    config user ldap edit "C24_ALFA.XSILVER.ORG" set server "10.109.19.88" set cnid "cn" set dn "dc=alfa,dc=xsilver,dc=org" set type regular set username "cn=administrator,cn=users,dc=alfa,dc=xsilver,dc=org" set password ENC  <cut>

    next end

     

    config user group

    edit "LOC-LDAP-Users" set member "usera" "userb" next end

     

    config firewall policy edit 2 set uuid affd8bd8-89c5-51e8-3761-c8443d143c74 set srcintf "port2"  <this is where test WKS Win7 sits set dstintf "port1"  <WAN port set srcaddr "all" set dstaddr "all" set action accept set schedule "always" set service "ALL" set logtraffic disable set fsso disable set groups "LOC-LDAP-Users" set nat enable next end

     

    # debug - showed that LDAP auth was successful

    diag debug fnbamd 7

    diag debug enable

     

    c2fgvm # [2135] handle_req-Rcvd auth req 1065032223 for usera in opt=00000500 prot=10 [605] fnbamd_pop3_start-usera [340] radius_start-Didn't find radius servers (0) [706] auth_tac_plus_start-Didn't find tac_plus servers (0) [1145] __fnbamd_cfg_get_ldap_list_by_group-Loading LDAP server 'C24_ALFA.XSILVER.ORG' for usergroup 'LOC-LDAP-Users' (4) [871] resolve_ldap_FQDN-Resolved address 10.109.19.88, result 10.109.19.88 [1147] build_search_base-search base is: dc=alfa,dc=xsilver,dc=org

    [1267] fnbamd_ldap_init-search filter is: cn=usera

    [492] create_auth_session-Total 1 server(s) to try [263] start_search_dn-base:'dc=alfa,dc=xsilver,dc=org' filter:cn=usera

    [1652] fnbamd_ldap_get_result-Going to SEARCH state [2843] auth_ldap_result-Continue pending for req 1065032223 [1550] fnbamd_ldap_get_result-Not ready yet [2843] auth_ldap_result-Continue pending for req 1065032223 [296] get_all_dn-Found DN 1:CN=usera,CN=Users,DC=alfa,DC=xsilver,DC=org

    [310] get_all_dn-Found 1 DN's [344] start_next_dn_bind-Trying DN 1:CN=usera,CN=Users,DC=alfa,DC=xsilver,DC=org [1700] fnbamd_ldap_get_result-Going to USERBIND state [2843] auth_ldap_result-Continue pending for req 1065032223 [570] start_user_attrs_lookup-Adding attr 'memberOf' [591] start_user_attrs_lookup-base:'CN=usera,CN=Users,DC=alfa,DC=xsilver,DC=org' filter:cn=*

    [1756] fnbamd_ldap_get_result-Entering CHKUSERATTRS state [2843] auth_ldap_result-Continue pending for req 1065032223 [793] get_member_of_groups-Get the memberOf groups. [828] get_member_of_groups- attr='memberOf', found 2 values [837] get_member_of_groups-val[0]='CN=UG_SSO_Users,CN=Users,DC=alfa,DC=xsilver,DC=org' [837] get_member_of_groups-val[1]='CN=RUSR_Users,CN=Users,DC=alfa,DC=xsilver,DC=org' [626] start_primary_group_lookup-starting check... [630] start_primary_group_lookup-number of sub auths 5 [648] start_primary_group_lookup-base:'dc=alfa,dc=xsilver,dc=org' filter:(&(objectclass=group)(objectSid=\01\05\00\00\00 \00\00\05\15\00\00\00\bb\f4\90\f4\30\bd\1f\79\0b\35\92\63\01\02\00\00))

    [1780] fnbamd_ldap_get_result-Entering CHKPRIMARYGRP state [2843] auth_ldap_result-Continue pending for req 1065032223 [776] get_primary_groups-primary group: CN=Domain Users,CN=Users,DC=alfa,DC=xsilver,DC=org [1814] fnbamd_ldap_get_result-Auth accepted [1925] fnbamd_ldap_get_result-Going to DONE state res=0 [2748] fnbamd_auth_poll_ldap-Result for ldap svr 10.109.19.88 is SUCCESS [2768] fnbamd_auth_poll_ldap-Skipping group matching [899] find_matched_usr_grps-Skipped group matching [182] fnbamd_comm_send_result-Sending result 0 (error 0, nid 0) for req 1065032223 [638] destroy_auth_session-delete session 1065032223

    Tindrli
    TindrliAuthor
    New Member
    July 17, 2018

    Hey,

     

    I forgot to update this thread with new information. I made it work after a while. Problem was with SSO configuration on the box  itself. When i tried to set it up initially I used to choose advanced mode and that's where the problem was. When i changed that portion of the setup to standard, i was able to see all the users and groups. Now i can setup my policies based on security groups on AD. Glad to see that someone actually tried to replicate this issue and found a minute to reply. 

    xsilver_FTNT
    Staff
    xsilver_FTNT
    Staff
    July 18, 2018

    Hi,

    from your initial post I thought you are trying to set up LDAP users, not FSSO, which is completely different auth method.

     

    BTW: Standard vs Advanced FSSO is almost only about format of the user groups in filter.

    Standard uses MSFT fromat while Advanced uses LDAP format for group written.

    So if you do set LDAP into FSSO Agent on FGT, then format of chosen groups is obviously LDAP one, and if Collector run in Standard mode and process groups in MSFT format, then those from FGT and Collector can not match!

    But you can set Collector to Advanced, set Group Filter on Collector and also use LDAP format and groups pushed to FGT. With no problem.

    Just to clarify and help someone who will accidentally read that.

    Terms & ConditionsAccessibility statement