Technical Tip: Importing LDAP user and applying two factor email Token

[carabhavi]

Description

This article describes how to import the LDAP users in FortiGate and apply two-factor email Token via CLI.

Scope

FortiGate.

Solution

Import the user to the FortiGate from GUI.

To import users from LDAP follow these steps:

1. Go to User & Devices -> User Definition and select 'Create New'.
   
2. On 'User Type', select 'Remote LDAP user' and select 'Next'.
   
3. On 'LDAP Server', Select the LDAP server name and select 'Next'.
   
   
4. Select the User, select '+ Add Selected ' and select 'Submit'.
   
   

Once the user is imported, it is possible to enable two-factor email Token via the CLI:

config user local
    edit TestUser
        set two-factor email
        set email-to "example@example.com"
        set ldap-server "LdapName"

      end

To avoid users authenticating against LDAP directly and bypass two factor email-token, use the command 'set username-sensitivity disable' under user settings. Refer to Technical Tip: Description of CVE-2020-12812 (bypassing two-factor authentication for LDAP users) an... for more information.