FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
lmateus
Staff
Staff

Description
When configuring LDAP authentication on FortiGate, the 'ldap-memberof' attribute can be used to check the user group membership to grant access accordingly.

For example:

config user group
    edit "first"
        set group-type sslvpn
        set ldap-memberof "CN=first,OU=Groups,DC=testlab,DC=com"
            set member "my-ldap-server"
        set sslvpn-portal "testportal"
    next
end



This will work, except for users that are only members of one group in Active Directory.

The "memberof" attribute of the LDAP user is only populated with groups to which the user belongs to, except the user Primary Group. This is why, when the user is only member of its Primary Group, the FortiGate LDAP authentication will fail after receiving empty member-of query result.

 


Reference

 


Scope

 


Workaround
As a workaround, an additional group membership should be added to the LDAP user and this group has to be set Primary group in Active Directory.

 


Problem Verification

 

 

Contributors