New Member

Solved

FortiGate successfully authenticates against LDAP server, but cannot browse users

Forum|Forum|1 month ago
August 6, 2026
9 replies
126 views

Hello,

I have a frustrating case where a H-A cluster successfully authenticates against an external LDAP server using port 636, but is not able to browse the users in it.

Testing a user is successful as well. Look at the attached screenshots.

I changed the “cnid” field several times, including “sAMAccountName”.

The version we are using is 7.4.12.

Best answer by AEK

I’d first ask LDAP admin which LDAP type is this (Novell, OpenLDAP, AD), and then try find the integration procedure with FGT for this LDAP type. On the other hand I’d try integrate this LDAP with other equipment to see if the issue is related to FGT.

Sat-Cit-AnandaAuthor

New Member

Did anyone had such an issue before? Any help will be appreciated.

AEK

SuperUser

Can you try with a domain admin? just to see if it is related to some rights.

AEK

Sat-Cit-AnandaAuthor

New Member

I’m actually trying with the domain admin account.

AEK

SuperUser

Is it active directory or other? And which version?

AEK

Sat-Cit-AnandaAuthor

New Member

IT is not an Active Directory. It is en external LDAP provider called GSLabs. It’s like Google directory.

I have tried the same connection from some of our servers, and it is working fine. The servers are able to browse the directory with the same account name I’m trying now.

AEK

SuperUser

If it is OpenLDAP then try uid as CNID.

AEK

Sat-Cit-AnandaAuthor

New Member

If I try to use uid, I cannot authenticate users against the LDAP.

AEKAnswer

SuperUser

I’d first ask LDAP admin which LDAP type is this (Novell, OpenLDAP, AD), and then try find the integration procedure with FGT for this LDAP type. On the other hand I’d try integrate this LDAP with other equipment to see if the issue is related to FGT.

AEK

Sat-Cit-AnandaAuthor

New Member

I think I found the answer. Unfortunately, not completely positive.

The LDAP provider is Authentik (https://goauthentik.io). It turns out they have a long story of LDAP integration problems. Look at this GitHub thread:

https://github.com/goauthentik/authentik/issues/7985

This is exactly the same issue as mine. Authentik does not support Samba scheme in their LDAP, and because of that, full integration with FortiGate (or any other vendor) is impossible. The funny part is that they even reject feature requests to integrate Samba:

https://github.com/goauthentik/authentik/issues/8711

I spoke with my DevOps colleagues and we agreed to integrate a subordinate LDAP service using OpenLDAP. It will sync the directories with Authentik. Then I will integrate the FGT with OpenLDAP. I know it will works, because I did such integrations in the past successfully.

AEK, thank you for the support.

Sign up

Login with SSO

Login to the community

Login with SSO