Skip to main content
emike09
emike09
New Member
August 17, 2021
Question

Invalid Password when authenticating admin via LDAP

  • August 17, 2021
  • 1 reply
  • 10105 views

Hey all,

Just getting our Fortigate 601e set up (FoS 7.0.1), first time working with Fortinet. When attempting to log in via my own domain account, I get a message saying Authentication Failed, and when viewing the logs, I see the following:

3 Minutes ago: Administrator (user.name) login failed from https(10.x.x.x) because of invalid password.

 

I'm really not sure what I'm doing wrong here, and I'm positive that the password is correct. I tried resetting it on our AD server as well. I've read multiple guides for LDAP setup, as well as watched a few YouTube videos, and the results are the same. What's even weirder, is that the logs show a couple successful logins for my domain account, however, I was still presented with Authentication Failed when the logs show that I logged in, when in fact, I did not.

 

35 Minutes ago: Administrator user.name logged in successfully from https(10.x.x.x)

 

Under LDAP Servers, I have one of our DCs configured. Using the IP address, sAMAccountName, Regular bind type using cn=, ou=, etc. When testing connectivity or user credentials, both test as Successful. 

 

I've configured a Remote User Group called FortiAdmin, Type: Firewall, and added the Domain Admins group. 

 

I created an Admin Profile called FortiAdmin with all permissions. Lastly, I created an Administrator called FortiAdmin: Match all users in a remote server group, with FortiAdmin for both the Administrator profile and Remote User Group. 

 

 I feel like I'm missing a step here. Any thoughts are appreciated! 

 

    1 reply

    xsilver_FTNT
    Staff
    xsilver_FTNT
    Staff
    August 18, 2021

    So it's LDAP Wildcard admin. Check your setup against those steps .. GUI of 7.x might be different however CLI is supposed to be same AFAIK. https://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=FD32608

     

    Hints: - I would test this with one of the default accprofile options like prof_admin or so.

    - make sure that the admins group is not used anywhere else besides that 'config system admin' setting

    - make sure that the remote admin has 'set wildcard enable'

    emike09
    emike09Author
    New Member
    August 27, 2021

    Just to follow up on this - After much troubleshooting with Fortigate engineers, it turns out it was something on our domain. A legacy attribute called msNPAllowDialin. Fortigate can work with this, it just needs to be configured via CLI. Make sure to change anything inside of [ ] to reflect your own environment. 

      

    config user ldap
         edit "[domain controller]"
             set server "[IP or DNS Address]"
             set cnid "sAMAccountName"
             set dn "[DC=domain,DC=org]"
             set type regular
             set username "CN=[user],OU=[group],DC=[domain],DC=[org]"
             set member-attr "msNPAllowDialin"
             set group-member-check group-object
         next
     end

    Terms & ConditionsAccessibility statement