- The username case sensitivity feature is only available once enabled with two-factor authentication. The username case sensitivity is enabled by default once two-factor authentication is enabled. Make sure the settings in the local user group do not include the remote LDAP server specification.
- The username-sensitivity is only available per user; a global configuration for case sensitivity is not available.
config user local
edit "BIGCAP"
set type ldap
set two-factor fortitoken
set fortitoken "FTKMOB13D197BBAE"
set email-to "BIGCAP@fortinet.com"
set username-sensitivity Enable <----- Username case sensitivity is enabled.
set ldap-server "LDAP"
next
end
edit "LIMyd"
set type ldap
set two-factor fortitoken
set fortitoken "FTKMOB13D197BBAF"
set email-to "LIMydP@fortinet.com"
set username-sensitivity Enable <----- Username case sensitivity is enabled.
set ldap-server "LDAP"
next
end
config user group
edit "SSLVPN"
set group-type firewall
set authtimeout 0
set auth-concurrent-override disable
set http-digest-realm ''
set member "test2" "YEENDUEN" "LIMyd"
next
end
- The exact match username with 'BIGCAP' or 'LIMyd' works fine with FortiToken when logging to SSL VPN.
- Logging in with a username as 'limyd' or 'bigcap' will normally get a permissions denied prompt.
Sample SSL VPN debug log:
[2031:root:86]login_failed:405 user[limyd],auth_type=1 failed [sslvpn_login_unknown_user]
5. To turn on the debug log on SSL VPN:
diagnose debug disable
diagnose debug application sslvpn -1
dia de application fnbamd -1
diagnose vpn ssl debug-filter src-addr4 X.X.X.X //User public IP
diagnose debug enable
Related document:
SSL VPN with LDAP user authentication
|
