New Member

Solved

SSO issues/problems

Forum|Forum|9 years ago
September 8, 2016
11 replies
63016 views

Hi all

I am new to Fortigate (this is also my 1st post to the forum) and attempted to setup FSSO. I followed the steps as described in this link (http://cookbook.fortinet.com/providing-single-sign-using-ldap-fsso-agent-advanced-mode-expert/), hiowever after completing all the steps - I can see the logins from my users in the FSSO agent installed on the DC, however I am seeing nothing on Fortigate. There is no user entry under "User & Device > Monitor > Firewall" - and from CLI I get the below:

# diagnose debug authd fsso list
----FSSO logons----
Total number of logons listed: 0, filtered: 0
----end of FSSO logons----

Did I miss something or do something wrong? Any advice welcome.

Best answer by xsilver_FTNT

As you set up standalone Collector Agent on DC (if you followed cookbook receipt), then you do not need Local FSSO poller on FortiGate .. remove it from 'config user fsso-polling'.

Make sure that your fsso 'config user adgrp' records are paired to right Collector "TCMVPN-FSSO" and not to local poller.

Then check users in Collector / Show Logon Users and their group membership. It seems to me probable that they are not matching group filters set and therefore they are not reported to FortiGate. Check Group Filters on Collector and on FortiGate. If you run in advanced mode then filters should be in LDAP format like "CN=group,DC=example,DC=com". Also make sure that you have selected LDAP objects which are actually groups (they must have LDAP ObjectClass=group) and not users or anything else!

RigAuthor

New Member

Hi

Thanks for the advice. Running the commands I get the the below output for the 1st set.

_event_read[TCMVPN-FSSO]: received heartbeat 100408
[authd_fsae_app.c:116]: num 1, idx 0, 127.0.0.1:8000
_event_error[Local FSSO Agent]: error occurred in read: Connection refused
disconnect_server_only[Local FSSO Agent]: disconnecting

I checked the DC ports (netstat -ant| more) and I can see it listening on the ports 389,3268 and 8000 -- but no 8002.

From the FSSO Agent on the DC I can see that the listening ports are configured as Fortigate - 8000 and DC agent - 8002. Windows Firewall is disabled completely with no 3rd party FW installed.

For the second set of commands I get the below output:

 # diagnose debug authd fsso server-status
Server Name Connection Status Version
----------- ----------------- -------
Local FSSO Agent waiting for retry 
TCMVPN-FSSO connected FSSO 5.0.0244

xsilver_FTNTAnswer

Staff

As you set up standalone Collector Agent on DC (if you followed cookbook receipt), then you do not need Local FSSO poller on FortiGate .. remove it from 'config user fsso-polling'.

Make sure that your fsso 'config user adgrp' records are paired to right Collector "TCMVPN-FSSO" and not to local poller.

Then check users in Collector / Show Logon Users and their group membership. It seems to me probable that they are not matching group filters set and therefore they are not reported to FortiGate. Check Group Filters on Collector and on FortiGate. If you run in advanced mode then filters should be in LDAP format like "CN=group,DC=example,DC=com". Also make sure that you have selected LDAP objects which are actually groups (they must have LDAP ObjectClass=group) and not users or anything else!

RigAuthor

New Member

Hi xSilver - thank you for the Feedback. I removed the local FSSO Agent and also changed the collector to Advanced Mode on the DC.

Everything is working now as expected - policies work and the Users are populated correctly. Thanks :)

gsarica

New Member

Don't mean to hijack this thread, but xsilver can you explain something that you mentioned there? We're using our AD servers as SSO on our FortiGate, no local agent, polling only. And this does work great as it assigns a user to a device when they log on.

I noticed that SSO only assigns users to devices when they log in if I choose security groups in the SSO config. I can't use 'users' or 'OU' even though they are available as selections. If I choose an OU, in the logs it shows users signing in and out, but users won't be assigned to a device. Is there a reason only security groups can be used? Thanks!

imanet

New Member

Hi if you want to config fsso in polling mode first you just need an active directory user which member of "domain users" and "event log reader" group

second if you have number of active directory server JUST select the one which has a global catalog role

this method is very simple an connect immediately after you refresh the page

Sign up

Login with SSO

Login to the community

Login with SSO