New Member

Solved

Import LDAP Users with FortiToken-Mobile for SSL VPN

Forum|Forum|9 years ago
April 3, 2017
7 replies
19175 views

Hello everyone,

i need to build a new customer environment, wheree a SSL-VPN with FortiToken-Mobile as a second factor for authentication need to be implemented.

Unfortunately the new customer has more than 200 Employees, which means it would be a lot of clicking-work to import all the LDAP users and assign a FortiToken-Mobile to the account and send the Activation-Code. And directly adding an AD Group wouldn't help either...

My Question is if there is an easy (lazy) way to import so much Users, assign them FortiToken-Mobile and send the Activation Codes?

We managed another customer with regular FortiTokens where a FortiAuthenticator reads the Token-SN from an extra field from the user attributes, but i couldn't figure out how this would work with mobile tokens.

Looking forward for your reply's

Thank You

5.2

Best answer by xsilver_FTNT

I would suggest to check the log and look for the reason why token was not assigned.

Possible reasons I see .. - there was no token in available state mean unsuitable for being assigned

- tokens there were somehow imported (for example from config restore) but they belong to license which belongs to (was activated on) different FGT/FAC unit and so this FAC is not allowed/permitted to assign such token to user (FortiGuard will reject such assignment request)

- there is no email address synced from LDAP and therefore there is nowhere to deliver activation codes => assignment is canceled for that reason

- there is no working SMTP server (see https://<FAC-IP|FQDN>/admin/system/smtpserver/ ), so result is the same as in previous step, FAC is unable to deliver the activation code and so assignment could not be completed = result is canceled action and unassigned token. Also check Email Services and which one is used for users. If default, then on previous SMTP Servers check which one is default.

Use one test user and check above conditions.

Then delet that user from FAC Remote Users and let it resync (wait sync timer or force manual resync via menu button).

Then check if token was assigned and if not check for reason in log.

If it is going to work, then you can probably delete all Remote Users synced via that rule and let them resync as with test user.

MikePruett

New Member

I would use a FortiAuthenticator and then just allow it to auto issue mobile tokens to users that are imported from the AD groups.

Would be quick and relatively easy management wise.

xsilver_FTNT

Staff

Mike is right, this is the lazy man way. Feature on FortiAuthenticator (FAC) you are looking for is called 'Remote User Sync Rules'. In Authentication/User Management GUI section.

Allows you to dynamically sync users from LDAP. So whenever LDAP changes it is reflected on FAC. If rule has token priority set to assign available mobile token, then user will automatically get activation instructions and codes via email/SMS (email address or mobile phone number has to be part of user data and synced to FAC).

When user is removed from LDAP, then FAC will remove user and release the token for future re-use as well.

Pretty neat and useful feature I think.

Best regards,

Tomas

makeAuthor

New Member

Hi Guys,

thank you for your answers.

It took some time but I could finally install a FortiAuthenticator for Evaluation.

It is configured with 100 FortiToken Mobile (all Status available), the LDAP Connect to the DC and it successfully synced testusers (with E-Mail addresses) with a User Group on the FortiAuthenticator via the Remote User Sync Rules. The Sync rule includes Token-based authentication sync priorities: FortiToken Mobile (assign an available token)

The remaining problem is that the FortiTokens Mobile are not assigned to the users.

I checked this in Authentication > User Management > FortiTokens. The User field is empty on all tokens.

Also under Authentication > User Management > Remote Users. The Token field is empty by all testusers.

Looking forward for your reply's Thank You very much

emnoc

New Member

You should be able to export the AD-user by doing a simple ldap search and get the username@domain.com and script it to blast the activation codes.

Might take a little leg work to get the ldap query for the user name and email and loop thru the available activation codes to send to users.

Are all users in the same AD group ? Can you query that group for the username and email-address ?

just my 2cts

e.g

ldapsearch -x -h 10.0.1.1 -D "ken.felix@mydomain.com" -W -b "CN=VPN Users,OU=Access groups,OU=Road Warriors,DC=mydomain,DC=com" | grep member: | cut -d "=" -f2

Once you get the users, just mail blast them the activation code to username@yorudomain.com

Ken

Sign up

Login with SSO

Login to the community

Login with SSO