Description
This article describes how to configure Google secure LDAPS in FortiGate using certificate authentication.
Scope
FortiGate7.2.0+.
Supported Google Suite plans:
Business Plus; Enterprise; Education Fundamentals, Education Standard, Teaching and Learning Upgrade, and Education Plus.
Solution
Some LDAP servers require a client certificate to perform peer verification instead of password authentication. Google LDAPS is one example of such a configuration.
Starting with FortiOS 7.2.0, client certificate authentication can be configured when FortiGate is acting as an LDAP client.
Related document:
Configuring client certificate authentication on the LDAP server
Below is an example of Google Suite LDAPS integration.
- To create an LDAP Client in Google Suite, navigate to Apps -> LDAP, select 'Add LDAP Client', and define the LDAP client name and description. Select 'Continue'.
- Define access permission to specific groups, OUs, or the entire domain. Select 'Add LDAP Client'.
- Download the certificate so it can be imported to FortiGate later.
- After being returned to the LDAP Client details, select 'Service status' and turn it on.
- Extract the compressed file downloaded from step 3. It should contain the certificate and key files.
To import the certificate to FortiGate, navigate to System -> Certificates, then select Create/Import -> Certificate and choose the 'Import Certificate' method.
- Select 'Certificate' and browse to the certificate and key files. Define a certificate name and select 'Create'.
Note: Leave the password fields empty.
- Create an LDAP server entry.
Note:
A Distinguished Name should contain the OU 'users' and any other OU in the path to where users are located. If the DN is incorrect, the following error message will be displayed:
- Edit configuration from the CLI and enable the certificate authentication option.
CLI Configuration:
config user ldap
edit "GoogleLDAPS"
set server "ldap.google.com"
set server-identity-check disable
set cnid "uid"
set dn "ou=users,dc=colombas,dc=me"
set secure ldaps
set port 636
set client-cert-auth enable
set client-cert "GoogleLDAPS"
next
end
Troubleshooting and verification:
- Debug logs can be enabled for the authentication daemon.
diagnose debug console timestamp enable
diagnose debug application fnbamd -1
diagnose debug enable
- Connectivity and User Credentials tests can be run from the GUI and CLI.
GUI Connectivity test and User Credentials test:
CLI Connectivity test:
diagnose test authserver ldap-direct ldap.google.com
CLI User Credentials test:
diagnose test authserver ldap <server_name> <username> <password>
