Skip to main content
FatalHalt
FatalHalt
New Member
April 18, 2016
Question

Two Factor with LDAP Groups

  • April 18, 2016
  • 1 reply
  • 7002 views

I'm curious if it's possible in any way to use two-factor authentication when I'm authenticating users via LDAP remote groups? 

 

My scenario is that I have a few different SSLVPN Portals depending on AD Membership. Currently the users just sign into the portal, their account is authenticated vs LDAP, and the membership returned to pick the best portal. I'd like to add Two-Factor authentication to this.

 

I know that I can create local users which are authenticated against LDAP, add two-factor to those, and put those local users into groups which are each then assigned to different VPN Portals. However in this case, group membership will change on occasion, and it would be easier to just handle this in AD, so if possible I'd like to just use the remote groups. 

 

The way I see such a thing working is: when the LDAP returns the memberships of the authenticated user, it could also return the users email, and the firewall could send a two-factor request to that email. 

 

Is this doable now? Or would this be a feature others would be interested in?

    1 reply

    FatalHalt
    FatalHaltAuthor
    New Member
    April 20, 2016

    Bump. Any thoughts?

    FatalHalt
    FatalHaltAuthor
    New Member
    April 20, 2016

    Fortinet support has confirmed this is only possible with FortiAuthenticator.

    xsilver_FTNT
    Staff
    xsilver_FTNT
    Staff
    April 22, 2016

    Hello,

    well there might be multiple possible scenarios .. but FortiAuthenticator (FAC) + Remote User Sync Rules following AD group assignment because fo LDAP filter used for sync, then any kind of token on FortiAuthenticator would work the best. Others are more or less NFR (new feature requests) or would end in semi-manual groups or token assignments. And that's why there is FAC as centralized platform.

     

    Synced email to FortiGate (FGT) would be NFR (new feature request) as it is not synced and need to be defined locally on FortiGate, and so this is similar scenario as you mentioned with groups assigned on FortiGate.

     

    Another possibility might be RADIUS based user on FGT .. AVP defining group is Fortinet-Group-Name (for normal auth, it could be defined for RSSO), then user to group assignment automatic through RADIUS based group match.

    Like there : http://kb.fortinet.com/kb/microsites/microsite.do?cmd=displayKC&docType=kc&externalId=FD36464

    But again, token to user managed manually, users managed manually on FGT .. it lacks elegance of automatic sync of users from LDAP as FAC does provide, so when new user appears it appear on FAC in next sync cycle, and if removed on AD it also dissapear from FAc (and if token assigned (HW/SH) then token released for free use by another user).

     

    King regards, Tomas

     

    Terms & ConditionsAccessibility statement