New Member

Solved

Google Workspace LDAPS integration partially works - help needed

Forum|Forum|22 days ago
September 13, 2026
22 replies
170 views

Hi guys,

I’m writing here after few weeks of working with Fortigate support. We went into dead end.

I have full admin right on Google Workspace and Fortigate 30G running 7.6.7 build 3704, I’ve configured the LDAP as follows:

FortiGate-30G (G_Workspace) # show
config user ldap
    edit "G_Workspace"
        set server "ldap.google.com"
        set cnid "uid"
        set dn "ou=users,dc=spxxxxxxx,dc=pl"
        set secure ldaps
        set port 636
        set client-cert-auth enable
        set client-cert "G_LDAP2"
    next
end

Test Connectivity always works (this is misleading), Test User Credentials work fine - on any user which exist on my Workspace.

Problem is when I want to press Browse button, I’m getting error “Invalid LDAP server” while from Workspace logs related to LDAP I can see:

Event:Search failed
Description: LDAP search with (objectClass=*) failed with INSUFFICIENT_ACCESS_RIGHTS.

Similar error I’m getting when I try to configure User Group based on G_Workspace profile - “Invalid LDAP server” “Insufficient access”

Do you have any hints how to fix this problem?

I believe that there is at least one working Google Workspace tenant out there sucessfully integrated with Fortigate FW ;)

Regards

Slawek

Best answer by funkylicious

I can see that there is also a user with credentials created for this LDAP client, based on the Access credentials at the bottom of the pic.

have you tried binding/inserting that user/pass into FortiGate where you change the Bind Type from Simple to Regular ?

as per the Insufficient access rights log, in the google docs i’ve found the following:

INSUFFICIENT_ACCESS_RIGHTS (50)

Returned when the the Secure LDAP service is OFF for the LDAP client - this we have confirmed it’s on as per the screenshot
Returned when the customer is not licensed to use the Secure LDAP service - would require one of the following ( Supported editions for this feature: Frontline Standard and Frontline Plus; Business Plus; Enterprise Standard and Enterprise Plus; Education Fundamentals, Education Standard, and Education Plus; Enterprise Essentials Plus. ) ; do you have another working LDAP service/client in order to clear this out?
Returned when the Bind request specifies a user that is not licensed to use Secure LDAP - i dont think it’s the case here
Returned when the Bind request specifies a user that is disabled - we dont have a bind user, but we can try as per the above suggestion
Returned when a subsequent Bind request (rebind) specifies a user that doesn't belong to an organizational unit that's enabled for authentication in the Secure LDAP configuration - no bind user
Returned when a SIMPLE Bind request specifies no credentials (unauthenticated) - this might hit since we dont have a bind user and just use cert auth

S

slvAuthor

New Member

One more thing, I did pcap of the traffic between FW and Google Workspace - TLS handshake is happening correctly and then entire session is encrypted in TLS 1.3 which make it unreadable.

funkylicious

SuperUser

have you also imported the CA Cert ?

"jack of all trades, master of none"

S

slvAuthor

New Member

Hi @funkylicious
This cert was taken from Workspace LDAP config section, together with it’s private key. This is self signed cert so I was able to import this cert only to System/Local Certificate section (as a one file - cert + private key glued).

Problem is that "G_LDAP2" is a self signed cert, so what CA cert I should download and from where? See below:

funkylicious

SuperUser

try https://pki.goog/repository/

since i couldnt find a more relevant KB in regards to the actual what you need to implement, have a read at these and maybe it will help

https://docs.fortinet.com/document/fortiauthenticator/8.0.0/examples/442690/google-workspace-integration-using-ldap

"jack of all trades, master of none"

S

slvAuthor

New Member

Are you sure? see attached screenshot - this is self signed cert. Issuer in this example is: >>LDAP Client« - not Google.

All Google Root CA I have added to my FW. If I remember correclty GTS Root R2 was missing so I added.

S

slvAuthor

New Member

TLS handshake is happening, Test User Credentials work fine - don’t you think that authentication is correct here? It’s happening based on cert+private key.

funkylicious

SuperUser

i would import GTS Root R1 and R2 just in case as CA’s into FortiGate.

in regards to test user credentials. have you also tried the wrong creds for a user to confirm that the GUI doesnt just throw a false positive ?

as per the logs you provided in the first post, i would focus on the Google side since it throws errors for insufficient rights. check again the permission for the app that you created in the google console

try to enable under config user ldap, set client-cert-auth enable if its not already

"jack of all trades, master of none"

S

slvAuthor

New Member

Test User Credentials work fine for proper creds, and giving “Invalid credentials” for incorrect one. I tested it many times.

“check again the permission for the app that you created in the google console” - I wish to do that, but I have no idea how to check it - could you guide me?

“try to enable under config user ldap, set client-cert-auth enable if its not already”
same here, I can’t find this option user the Directory>Users>specific user

Regards

Slawek

S

slvAuthor

New Member

Good catch!
I haven't had entry ldapconntimeout in my global config before.

I set ldapconntimeout to 1000 and remoteauthtimeout to 300

In attached logs you should see successful Test credentials and unsuccessful Browsing LDAP

console-output-CLI-Console.txt

funkylicious

SuperUser

nothing stands out in the logs for me, sorry.

try and have a look at google side also, since you get thrown those errors

https://knowledge.workspace.google.com/admin/apps/secure-ldap-service-error-code-descriptions#insufficient_access_rights_50

"jack of all trades, master of none"

S

slvAuthor

New Member

@funkylicious Thank you for your efforts.

I hope that someone on this Forum is using Google Workspace and was able to configure it and let me know where the problem is.
This is my last hope ;)

S

slvAuthor

New Member

Here you are:

funkyliciousAnswer

SuperUser

I can see that there is also a user with credentials created for this LDAP client, based on the Access credentials at the bottom of the pic.

have you tried binding/inserting that user/pass into FortiGate where you change the Bind Type from Simple to Regular ?

as per the Insufficient access rights log, in the google docs i’ve found the following:

INSUFFICIENT_ACCESS_RIGHTS (50)

Returned when the the Secure LDAP service is OFF for the LDAP client - this we have confirmed it’s on as per the screenshot
Returned when the customer is not licensed to use the Secure LDAP service - would require one of the following ( Supported editions for this feature: Frontline Standard and Frontline Plus; Business Plus; Enterprise Standard and Enterprise Plus; Education Fundamentals, Education Standard, and Education Plus; Enterprise Essentials Plus. ) ; do you have another working LDAP service/client in order to clear this out?
Returned when the Bind request specifies a user that is not licensed to use Secure LDAP - i dont think it’s the case here
Returned when the Bind request specifies a user that is disabled - we dont have a bind user, but we can try as per the above suggestion
Returned when a subsequent Bind request (rebind) specifies a user that doesn't belong to an organizational unit that's enabled for authentication in the Secure LDAP configuration - no bind user
Returned when a SIMPLE Bind request specifies no credentials (unauthenticated) - this might hit since we dont have a bind user and just use cert auth

"jack of all trades, master of none"

S

slvAuthor

New Member

We are using Education Fundamentals licence, I don’t have another LDAP unfortunetelly.
Yes there is an user generated by me, I was under impression that this user is for testing purposes.
OK - will change the binding and let you know soon!

S

slvAuthor

New Member

I started playing with certificate _only_ as Forti documentation stated that since some time or 7.4 version certificate is mandatory ...

S

slvAuthor

New Member

Hurray

Once I changed Bing Type to regular and used previosly generated credentials from Google Worspace LDAP I can browse the active directory.

Thank you so much @funkylicious - you are magician :) - I spent so many hours with TAC for nothing.

Regards

Slawek

INSUFFICIENT_ACCESS_RIGHTS (50)

INSUFFICIENT_ACCESS_RIGHTS (50)

Sign up

Login with SSO

Login to the community

Login with SSO