Technical Tip: How to configure LDAP services on FortiAuthenticator and integrate it to FortiGate for authentication

[lmarinovic]

Description.

This article describes how to configure LDAP services on the FortiAuthenticator and shows how to integrate with a FortiGate.
This includes the FortiAuthenticator as well as the FortiGate configuration.

Scope.

FortiGate.

FortiAuthenticator.

Solution

Diagram.

Internet <----> FortiGate <----> FortiAuthenticator <---->(LAN)

FortiAuthenticator Configuration.

1. Enable LDAP services on the interface connected to the FortiGate.

• Go to Network -> Interfaces -> Access Rights -> Services, select check box for LDAP (TCP/389).

2. Create Groups.

• LDAP Administrator  Group.

Go to Authentication -> User Management -> User Groups -> Create New, create new group named: ‘ldap_admins’.

• Create User groups.

Go to Authentication -> User Management -> User Groups -> Create New, create new group named: ‘testgrp’.

3. Create users and add them under the respective groups created earlier.

• Users.

     Go to Authentication -> User Management -> Local Users -> Create New.

      ldapadmin -> to the group ldap_admins.

      Add rights to the 'ldapadmin' user for LDAP browsing.

test1 -> to the group testgrp.

After configurations done:

• Users:

• Groups:

4. Configure Directory Tree as shown below. Ensure that the LDAP Administrator is a part of LDAP tree. The LDAP admin and the users MUST be contained as object below the 'Distinguished name' (= baseDN) configuration on FortiGate. If the Admin or user are outside of the baseDN, the objects won't be found.
   
   Go to Authentication -> LDAP Service -> Directory Tree.

FortiGate Configuration.

1. Configure LDAP services.

• Go to User & Authentication -> LDAP Servers -> Create New.

Complete using:

FortiAuthenticator Interface IP: Server IP/Name.

FortiAuthenticator LDAP Interface Service Port, default 389.

Distinguished Name. Same name used in FortiAuthenticator LDAP Service -> Directory Tree.

Username and Password.

2. Test Authentication from FortiGate CLI, with the command syntax as follows:

diagnose test authserver ldap <name of LDAP server configuration> <username> <password>

Example:

diagnose test authserver ldap LDAP ldapadmin admin$123

3. FortiAuthenticator Logs.

Go to Logging -> Log Access -> Logs, select 'ldapadmin' authentication log:

4. Create User Group.

Go to User & Device -> User -> User Groups, enter 'Name' and select 'Create New' under 'Remote groups', select the remote server created and select the required user group name.

5. User group created on firewall in the last step can now be selected on the appropriate firewall authentication policy.

Related articles:

• FortiGate / FortiOS 7.6.0 Administration Guide / Configuring an LDAP server
• FortiAuthenticator 6.5.0 Cookbook / Configuring LDAP on the FortiAuthenticator
• Troubleshooting Tip: FortiGate LDAP troubleshooting and debug logs created by fnbamd