FreeIPA with FSSO

Forum|Forum|1 year ago
October 31, 2024
1 reply
2052 views

Hello

Has anyone tried integrate FreeIPA with FSSO, like by sending syslog from the LDAP to FSSO agent or FortiAuthenticator, or any other method?

pminarik

Staff

Syslog can potentially work fully indepedently (taking both username and group from the message), or do membership lookup via relatively configurable LDAP lookups (collector Agent has separate LDAP config for Syslog), so I would expect both to work with Syslog.

Just keep in mind that there will be no dynamic IP change detection or logout detection. This will fully rely on the Syslog source sending these updates too.

Another possibility could be translating RADIUS accounting messages into FSSO. Same workflow as with Syslog: Receive > process (optionally LDAP group lookup) > generate FSSO session.

Other MS AD-integrated methods are not expected to work at all. (event log scraping, DC Agents, FSSOMA).

AEKAuthor

SuperUser

Thanks Minarik

Any document describing the procedure?

AEK

pminarik

Staff

You could try this doc to get an idea of how to configure it: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configure-Fortinet-Single-Sign-On-FSSO-for-SSL-VPN/ta-p/229274

The core is getting a sample of the Syslog messages and setting up the parsing rules for them. Then you need to decide if you can use the message itself for learning user groups, or whether to use LDAP for group lookups (in which case you will need to configure the LDAP portion, which is done similarly as with FortiGate/FAC being configured as LDAP clients - need to know how your LDAP tracks group membership, and then set the filters/objectClasses for it in the config).

There is a test-field in Collector/FAC so you can paste in the Syslog message and directly test if the filters match and extract the values correctly.

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded