Help
FortiProxy
FortiProxy provides enterprise-class protection against internet-borne threats and Advanced Web Content Caching
alwis
Staff
Staff

Created on ‎04-11-2023 09:46 PM Edited on ‎08-04-2023 01:55 AM By Moderator

Article Id 252093

Technical Tip: NTLM Authentication with an alternative UPN suffix

Description

This article describes how to configure LDAP Setting on FortiProxy when LDAP has an alternative UPN suffix.
Scope FortiProxy.
Solution

If there is an alternative UPN configured on the LDAP Server, the existing user that uses the new suffix is not able to authenticate successfully. 

 

  1. Before:

 

LDAP1-example.PNG

 

  1.  After:

 

LDAP2-example.png

 

  1.  Log Output:

 

LDAP3-example.PNG

 

Add the following on the existing LDAP settings:

 

config user ldap
    edit "LDAP"
        set account-key-processing strip       
        set account-key-name "sAMAccountName"  
    next
end

 

Result:

 

LDAP4-example.PNG

 

 For these changes, FortiProxy will strip the domain string from the UPN.

 

Related article: 

Technical Tip: Strip domain strings from a UPN in Kerberos.
648
0 Kudos
Suggest New Article
Article Feedback
Broad. Integrated. Automated.

The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.

Social Media
Security Research
Company
News & Articles
Contact Us

Copyright 2025 Fortinet, Inc. All Rights Reserved.