Description
This article describes how to resolve an error where the group does not match while configuring an LDAP admin user that exists on FreeIPA.
Scope
FortiGate.
Solution
- The first thing required is successful connectivity to the LDAP server.
- Furthermore, create a group on FortiGate and add the group in the remote server as below:
config user group
edit "firewall_admins"
set group-type firewall
set authtimeout 0
set auth-concurrent-override disable
set http-digest-realm ''
set member "DS1"
config match
edit 1
set server-name "LDAPS"
set group-name "cn=firewall_admins,cn=groups,cn=fortinet,dc=corp,dc=test,dc=com"
next
end
next
end
config system admin
edit "ldaptest"
set remote-auth enable
set accprofile "super_admin"
set vdom "root"
set remote-group "firewall_admins"
next
end
- After, run the following debug commands. The error output shown below will appear:
2024-08-21 12:03:51 [984] __ldap_next_state-State: User Membership Query -> Done
redacted other group membership
2024-08-21 12:03:51 [1982] ldap_copy_grp_list-copied cn=firewall_admins,cn=groups,cn=fortinet,dc=corp,dc=test,dc=com
2024-08-21 12:03:51 [627] fnbam_user_auth_group_match-req id: 90379028230145, server: DS1, local auth: 0, dn match: 1
2024-08-21 12:03:51 [581] __group_match-Check if LDAPS is a group member
2024-08-21 12:03:51 [208] find_matched_usr_grps-Failed group matching
2024-08-21 12:03:51 [239] fnbamd_comm_send_result-Sending result 1 (nid 0) for req 90379028230145, len=3217
Solution:
Set the following attributes under the LDAP settings through the CLI:
set group-member-check user-attr
set group-search-base "cn=groups,cn=fortinet,dc=corp,dc=test,dc=com"
set group-filter "(objectClass=ipausergroup)"
set member-attr "memberof" <- Verify this attribute claim on the FreeIPA portal as well.
And under the firewall group settings, change the following using the CLI:
config user group
edit “firewall_admins”
config match
edit 1
set group-name "cn=groups,cn=fortinet,dc=corp,dc=test,dc=com"
next
end
next
end
After making the changes, it will be possible to log in as the user from FreeIPA as a FortiGate Admin.
