Skip to main content
FTNT-UFO
FTNT-UFO
New Member
August 29, 2023
Question

Not able to import Open LDAP user to FortiAuthenticator

  • August 29, 2023
  • 5 replies
  • 6099 views

I may have hours of experience on both FAC and Open-LDAP, and I am trying to make the LDAP import user part working for me.  So far, I have already setup an Open-LDAP on 10.106.6.160, and is trying to see if I could import these users to my FAC.  

 

1). Here is my LDAP edit page, where I always have to input values on these "query elements" fields on that page, which are not optional part.

LDAP.png

2) When I have the previous page saved, and click the "import users" button, and have reached the "Import Remote LDAP Users" page. Without any extra editing, I was able to see 5 created LDAP user account here. But while I was to have them imported to FAC, I have got such failure: 

Unable to import " uid=testGeeks1,out=people,dc=pluto,dc=fortinet,dc=com": entry does not match the configured filter. "  

 

LDAP_USER.png

Any  ideas what I did wrong here ?  Thanks, 

 

Jack 

5 replies

dbu
Staff
dbu
Staff
August 29, 2023

Hello Jack, 

Thank you for reaching out. 

It looks like the attribute values configured on FortiAuthenticator and OpenLDAP do not match. 
Could you please change the value for ObjectClass from "person" to "posixAccount" and test again.

If it does not work please check you LDAP settings what is configured under ObjectClass for that user and try to match in FortiAuthenticator. 

Please check and let us know.

 

 

FTNT-UFO
FTNT-UFOAuthor
New Member
August 29, 2023

Thanks for the response, I have done what you suggested on the first setup page, here is the screenshot from the 2nd import page. 

 

LDAP_USER2.png

As you may find, 

1) I have changed from "person" to "posixAccount" on the LDAP setup page, and this is used as the filter value on this import page. 

2) I am doing the single users import mode. 

3) When I select "testGeeks1", and try to have it imported, I have seen such error messages at the top of the page. 

 

Thanks, 

 

Jack 

 

dbu
Staff
dbu
Staff
August 29, 2023

Hello Jack, 

Thank you for your update.

Now i believe you should replace the Username attribute under the LDAP configuration. 

Can you please try add "uid" instead of "testGeeks" and share results. 

Regards!

FTNT-UFO
FTNT-UFOAuthor
New Member
August 30, 2023

Thanks for the Tips.  I have tried  "import users" option, it did have the users imported from LDAP !  

LDAP_USER3.png

But my next question is, how to make the similar type of import, if I was to select  "import users by group memberships" option. ?  The above 3 users are of the same group.  When I was to select this option, nothing was imported in the end.

 

Thanks, 

 

Jack 

 

 

 

dbu
Staff
dbu
Staff
August 31, 2023

Hello Jack, 

 

You need to correct the filter when searching for the group membership. 
What is the filter shown when you try to import users from group membership ? 

Does this filter shows the users ? 

 

What was the filter when importing a single user ? 


Please try again importing with group membership and check on the logs, what it says for this import ?

Regards,
Dorel


FTNT-UFO
FTNT-UFOAuthor
New Member
September 5, 2023

This was the filter page when I use the "import users" option to have the users imported. 

LDAP_USER4.png

When I was to do "import users by group memberships", I have  chosen  the "Group attribute" button, instead of "User attribute" button on that page. 

 

 

 

 

dbu
Staff
dbu
Staff
September 5, 2023

I mean like here : 

 

queryelements1.PNG

 Now we see the filter used for this group membershipqueryelements2.PNG

 

If you still face an error remember to share the error here. 

Check what is configured for this user as object class on the remote server and match the config in FAC. Edit the filter properly. 

 

FTNT-UFO
FTNT-UFOAuthor
New Member
September 5, 2023

This is the settings on my "Import Remote LDAP Users by Group Memberships" page: 

LDAP_USER5.png

dbu
Staff
dbu
Staff
September 6, 2023

I see that filter is working and showing the entries. Now if you  select  "ou=people " and try to import does it fail ? 

If Yes show the error. 

Try also to change the value from "posixGroup" to "InetOrgPerson" . 

Let me know.

FTNT-UFO
FTNT-UFOAuthor
New Member
September 7, 2023

When I was trying to do the import by the group option, it was executed w/o any issues, but nothing was imported either.  

 

dbu
Staff
dbu
Staff
September 7, 2023

Can you please show me the logs regarding this activity from : 

Logging > Log Access > Logs 

We should have some info there for this import for example :

logsldap.PNG

 

Please click each log entry so we can see the message displayed for each of them. 

 

Alternatively, you can download a report summary and i can check it for you :

repsummary.PNG

 

 

Regards!

 

 

Terms & ConditionsAccessibility statement