Skip to main content
TEN_IT
TEN_IT
New Member
August 8, 2018
Solved

Nested LDAP Groups for SSL VPN

  • August 8, 2018
  • 3 replies
  • 12512 views

Hello,

 

we are running on FortiOS 5.6.3.

I try to use nested LDAP Groups for Authentication.

Users Accounts are member of the LDAP Group: "GL_SSLVPN"

Global Group is member of "L_SSLVPN" Group 

The  "L_SSLVPN" Group should be authenticated in Fortigate.

As discribes here:

http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=FD37091

 

the follwing Settings should be made:

config user ldap edit "example.local" set group-member-check user-attr set search-type nested next end

 

But the "set search-type nested" value is not available in FortiOS 5.6.

Any idea how to implement nested LDAP Groups now, or isn't this possible anymore?

 

Regards 

Thomas

Best answer by xsilver_FTNT

Hi,

 

FOS 5.6 has replaced 'search-type nested' with more flexible group filter.

Use something like below in LDAP config:

set group-filter "(|(&(objectclass=group)(member:1.2.840.113556.1.4.1941:=%u))(&(objectClass=group)(member:1.2.840.113556.1.4.1941:=%pg)))"

 

Works for me on 5.6.4 build 1575, and should work for you as well.

 

EDIT-2018-09-04: summarized that in KB http://kb.fortinet.com/kb...amp;externalId=FD41657

3 replies

xsilver_FTNT
Staff
xsilver_FTNTAnswer
Staff
August 8, 2018

Hi,

 

FOS 5.6 has replaced 'search-type nested' with more flexible group filter.

Use something like below in LDAP config:

set group-filter "(|(&(objectclass=group)(member:1.2.840.113556.1.4.1941:=%u))(&(objectClass=group)(member:1.2.840.113556.1.4.1941:=%pg)))"

 

Works for me on 5.6.4 build 1575, and should work for you as well.

 

EDIT-2018-09-04: summarized that in KB http://kb.fortinet.com/kb...amp;externalId=FD41657

thorn_FTNT
Staff
thorn_FTNT
Staff
September 3, 2018

In 5.6,  nested group search option has been replaced with a group filter string. To support the retrieval of nested group information of primary group, add a "%pg" token in group filter along with "%u". So in order to get the full list of groups a user belong to please try the following filter:

 

config user ldap

    edit "AD-LDAP"

        set server ...

        set cnid "cn"

        set dn ...

        set type regular

        set username ...

        set password ...

        set group-filter "(|(&(objectclass=group)(member:1.2.840.113556.1.4.1941:=%u))(&(objectClass=group)(member:1.2.840.113556.1.4.1941:=%pg)))"

    next

end

xsilver_FTNT
Staff
xsilver_FTNT
Staff
September 4, 2018

just to complete that, got nested LDAP change thing summarized in KB article

http://kb.fortinet.com/kb...amp;externalId=FD41657

ahualde
ahualde
New Member
October 4, 2019

I have the problem in 6.0.5

The command group-filter that you use and appears in the Technical note (https://kb.fortinet.com/kb/viewContent.do?externalId=FD41657&sliceId=1) it's not longer available in my CLI....

I try to use group-objec-filter command but no luck..

 

any idea?

 

ahualde
ahualde
New Member
October 9, 2019

Solved.

this unit it's managed via FortiManager.

By default in Fortimanager the LDAP configuration has group-object-filter configured, since this last is there, the group-filter will not be available anymore under CLI.

We have deleted the group-object-filter from Fortimanager settings, and add the filter to the group-filter

After these changes the group-filter is working and nested group functioned as expected

Terms & ConditionsAccessibility statement