Skip to main content
6sITdept
6sITdept
Visitor III
September 19, 2022
Question

LDAP Credentials fail to some users.

  • September 19, 2022
  • 4 replies
  • 4438 views

I have a fortigate 100E.  I recently replaced an Domain Controller (it crashed) that the fortigate was connected to through LDAP.  I have updated the LDAP settings to the new Domain Controller. It passes the "test connectivity" test. 

However going to "Users and Authenication"->"Ldap Servers"-> select LDAP server-> click "Test Users Credentials"; the some users cannot get the credentials validated.  it is weird, I can't figure out why some people (like myself) can get "User Credentials Successful" and some users get "User Credentials Invalid Credentials"

The Common Name Identifier is SAMAccountName

 

Any thoughts how to correct this? 

4 replies

Shilpa1
Staff
Shilpa1
Staff
September 20, 2022

Hello @6sITdept

 

As  I understand, your LDAP connection status shows Successful. However, unable to validate the user credentials even if it is right. Error > User credentials Invalid credentials.


Next Action Plan to identify the issue:

 

Follow the below link on how to collect logs using putty.
https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-create-a-log-file-of-a-session-using-PuTTY/ta-p/194148?externalID=FD36043

 

Putty 1 :
diagnose debug app fnbamd -1
diagnose debug enable

 

Follow the same steps to reproduce the issue: Go to >>Users and Authentication"->"Ldap Servers"-> select LDAP server-> click "Test Users Credentials

 

Use the below command to disable debug:

 

di de di 

Simultaneously on Putty 2 :

diagnose sniffer packet any "host x.x.x.x" 6 0 l

Here x.x.x.x is the ldap server IP.
Use ctrl+C keys to stop the sniffer

 

Regards,
Shilpa C.P

6sITdept
6sITdeptAuthor
Visitor III
September 20, 2022

Hello Shilpa.  I have done this.  is there something that I am looking for?

Markus_M
Staff & Editor
Markus_M
Staff & Editor
September 20, 2022

Hello 6sITdept,

 

fnbamd is the authentication daemon that will show any LDAP and RADIUS authentication that FortiGate creates and the results of it. Failed authentications will show there.

You might only want to add a timestamp to the log:

diag debug console timestamp enable

diag debug app fnbamd -1

diag debug enable

 

How they exactly looks like depend on the setup. There will be a binding with the bindDN you are using and another bind with the user you try to authenticate. After that you typically should see a memberof query. That again depends on the setup.

 

Best regards,

 

Markus

6sITdept
6sITdeptAuthor
Visitor III
October 18, 2022

I may have solved the problem but want your opinion.  on our Active Directory, we set the "Log on To" which restricts which computers the user can log on to.  when I removed it (ie no restriction). the user was able to connect the LDAP.  and then VPN started working again.  Anyone have an opinion on this?  would this be the issue?  is there a work around so I can restrict computers?

Terms & ConditionsAccessibility statement