Technical Tip: SSL VPN with LDAP-integrated Machine and User Certificate

[simonz_FTNT]

Description	This article describes how to configure SSL VPN to work with a computer and user certificate.
Scope	FortiGate.
Solution	This guide provides configuration on SSL VPN to match with the user and computer certificate. Refer to the below cookbook for a detailed setup on SSL VPN with LDAP-integrated certificate authentication. FortiGate LDAP matches certificate based on SAN and as per writing it only can support the UPN name which works for the user certificate as the LDAP user attribute contain UPN. LDAP computer attribute does not contain UPN, in order to get matched for both user and machine, it is necessary to use sAMAccountName as the matching attribute. It needs to be configured under 'config user ldap' referred to in the below example: config user ldap     edit "ldap-AD"         set server "172.18.60.206"         set cnid "cn"         set dn "dc=fortinet-fsso,dc=com"         set type regular         set username "cn=admin,ou=testing,dc=fortinet-fsso,dc=com"         set password ldap-server-password         set account-key-processing [same | strip] -> required to strip the domain name         set account-key-filter "(&(sAMAccountName=%s)(!(UserAccountControl:1.2.840.113556.1.4.803:=2)))"     next end Related article: Technical Tip: Strip domain strings from a UPN in Kerberos