Fortigate LDAP Authentication To FreeIPA with Group Filtering

Hi,

after defining the server you have to import users and groups for the usage in policies.

Technical Tip: How to configure LDAP server - Fortinet Community

This should fulfill your use cases, because only users/groups listed in your policy can access ressources.

Hi, I got this to work with the following configuration (User attribute checking):

config user ldap
  edit "ipa"
    set server <SERVER>
    set cnid "uid"
    set dn "cn=accounts,dc=example,dc=com"
    set type regular
    set username "uid=<BIND-USER>,cn=users,cn=accounts,dc=example,dc=com"
    set password <PASSWORD>
    set group-search-base "cn=groups,cn=accounts,dc=example,dc=com"
    set group-filter "(&(objectClass=groupofnames)(member=%u))"
    set secure ldaps
    set port 636
  next
end

config user group
  edit "remote_administrators"
    set member "ipa"
    config match
      edit 1
        set server-name "ipa"
        set group-name "cn=<GROUP>,cn=groups,cn=accounts,dc=example,dc=com"
      next
    end
  next
end

You have to specify 'cn=accounts' in the Base DN otherwise 'cn=compat' will be used.

Keep in mind that when you use LDAPS the certificate has to be trusted.