New Member

Solved

LDAP Lab - Error ldap_-5

Forum|Forum|7 years ago
June 29, 2018
5 replies
24576 views

Hi!

I'm working on a lab with a Windows 2012R2 and a Fortigate VM64-KVM (trial version) running version 6 (tried 5.6 as well).

When adding the LDAP server to the Fortigate, I always get error LDAP_-5 in red. And I can't get to query against it.

When I debug, I can authenticate against it:

FortiGate-VM64-KVM # diagnose test authserver ldap "LDAP DC-01" user1 testpassword authenticate 'user1' against 'LDAP DC-01' succeeded! Group membership(s) - CN=Domain Admins,CN=Users,DC=fgtad,DC=local CN=Domain Users,CN=Users,DC=fgtad,DC=local

Config:

config user ldap edit "LDAP DC-01" set server "10.10.10.11" set cnid "cn" set dn "dc=fgtad,dc=local" set type regular set username "LDAPconnect" set password ENC ceUtrzALEk7sWZhJjrw1JElXiACZiRxwHScw9Spf2i2Fmr/FGSis8dpC0JyAuuAya/kZ91ECVenukLlLy8xfFyfJZ6hGqheLG5PCIhjVF8aLQxaeWlb8XnPJvR/ZBSIArzHDq+bD34X9fuUO0oraXOJbhOZfshPzCpZzvgJT04fVKhvWtZ3A56yCmgS2VjSVmMh45g== next end

Any ideas?

Thanks!

Best answer by emnoc

A linux or Windows host :)

e.g

curl.exe -k -v -u "kfelix@example.com" "ldaps://1.1.1.1:636/DC=example,DC=com?cn,objectClass?sub?"

Place your credentials and make sure it pass, make sure a list of DNs are given

emnoc

New Member

Can you run a ldapsearch from the ldp-server ( ldp.exe or ldpexplorer or via ldapserach tool )?

Since you can authenticate that means the bind and baseDN are correct.

Also did you run the diagnose commands on the fgt

diagnose debug application fnbamd 255

diag enable

diag test autherver ldap-direct

diag disable

curl -k --tlsv1.2 --verbose -u "mydomain\kfelix" ldaps://10.1.1.2/DC=example,DC=com

jfgagnonAuthor

New Member

FortiGate-VM64-KVM # diagnose test authserver ldap-direct 10.10.10.11 LDAP server '10.10.10.11' status is OK

Where do you run curl from ?

emnocAnswer

New Member

A linux or Windows host :)

e.g

curl.exe -k -v -u "kfelix@example.com" "ldaps://1.1.1.1:636/DC=example,DC=com?cn,objectClass?sub?"

Place your credentials and make sure it pass, make sure a list of DNs are given

Adam789

New Member

if your windows server is running in VM and its network adapter is bridged to physical adapter( getting ip address from your router DHCP pool) and your FGT-VM is also having ip from the same DHCP.

Here i think the problem is, some ports are blocked by your Router and you can not contact your ldap server.

If you want to practice with it try to use GNS3 VM by installing Wind12or16 and FGT KVM and use lan interface between Wind and FGT.

you can also try to use in field of userid "username@domain.adds"

Fullmoon

New Member

Kindly try the ff changes.

jfgagnon@synovatec.com wrote:

config user ldap
edit "LDAP DC-01" set server "10.10.10.11" set cnid "sAMAccountName" set dn "dc=fgtad,dc=local" set type regular set username "LDAPconnect@fgtad.local"-----ldapconnect is a username having admin rights? set password ENC ceUtrzALEk7sWZhJjrw1JElXiACZiRxwHScw9Spf2i2Fmr/FGSis8dpC0JyAuuAya/kZ91ECVenukLlLy8xfFyfJZ6hGqheLG5PCIhjVF8aLQxaeWlb8XnPJvR/ZBSIArzHDq+bD34X9fuUO0oraXOJbhOZfshPzCpZzvgJT04fVKhvWtZ3A56yCmgS2VjSVmMh45g== next end

Pham_Phu_Cuong

New Member

I'm having the same problem with the ldap_-5. And this happens after an upgrade of a 90D from 5.2.x to 5.6.4.

First the existing ldap gives "Invalid credentials", then after I added a new Ldap, the ldap_-5 shows.

Does anyone else experience this? Is this a bug of 5.6.4 (FGT-90D)?

Thanks!

mseyda

New Member

We're are experiencing the same issue. We upgraded from 5.6 to 6.0 and are now receiving the ldap_-5 error. Did anyone resolve this issue?

Harmonikas

New Member

Hi

I have Fortinet 90D and last OS version 6.0.4 installed. After update from 6.0.3 my sync LDAP is not working from GUI. What is even more strange everything is working fine from CLI.

This is list of test I run from CLI:

1. execute ping ldap.server OK

2. execute telenet ldap.server 389 OK

3. diagnose test authserver ldap ..... OK

4. Set connection time out to 5000 (default 500) Done

5. diag sniffer packet any "port 636 or 389" .... OK

Config example:

Name: sync Server IP: x.x.x.x Server port: 389 Common Name Identifier: sAMAccountName Distinguished Name: DC=yo,DC=local Bind Type: Regular Username: yoyoyo Password: yoyoyo Secure Connection: no Connection Status: ldap_-5

But when i run connection test from GUI, I get same error like other users said in more then one topic on this forum. Are you going to fix this issue and when?

Thanks