Technical Tip: Limiting LDAP users and remote AD users to configure administration of a remote LDAP server

[Pedro_FTNT]

Description	This article describes how to limit LDAP user privileges required to configure remote LDAP server and how to limite specific remote AD users to allow FortiWeb remote administration.
Scope	FortiWeb
Solution	To limit specific remote AD users to allow FortiWeb remote administration.  In this example, the Remote LDAP user to be used as FortiWeb Remote Administrator is 'test2' and is configured in: tac.local/TOLUCA2/SISTEMAS2/IT4 Or: CN=IT4,OU=SISTEMAS2,OU=TOLUCA2,DC=tac,DC=local See Technical Tip: How to configure FortiWeb Remote LDAP Adminstrators. Step 2. Configure Admin user group. Configure: Group Name: CN=IT4,OU=SISTEMAS2,OU=TOLUCA2,DC=tac,DC=local. Select OK. To limit LDAP user privileges required to configure a remote LDAP server: See Technical Tip: How to configure a Remote LDAP Server and troubleshooting LDAP test connection. Step 1. To configure the Remote LDAP Server -> User DN. And see: See Page 389 of the FortiWeb Administration Guide. LDAP user ('User DN' in the FortiWeb GUI interface or 'username' in the FortiWeb CLI): username "<bind-dn_str>" <- '...of an LDAP user account with permissions to query the distinguished-name...' The User DN (username) only needs to have permissions to query the distinguished-name. It only needs permissions to query the 'distinguished-name': Read All Properties and List Content Options needs to be configured to the 'User DN' in the User Group or Organizational Unit where the remote LDAP user is to be used as a Remote FortiWeb LDAP Administrator. Example: Configuring Remote LDAP Server and using LDAP user: 'webadmin'. 'webadmin' user is not an Active Directory or LDAP user Administrator. 'webadmin' user is configured only as Domain User. Configuring privileges to Read All Properties and List Content: In this example, the Remote LDAP user to be used as FortiWeb Remote Administrator is configured in: tac.local/TOLUCA2/SISTEMAS2/IT4 Or: CN=IT4,OU=SISTEMAS2,OU=TOLUCA2,DC=tac,DC=local Remote user: 'test2'.  Go to OU=SISTEMAS2 -> Properties -> Security -> Advanced. Select: Add. Select: Select a principal. Find and select the: 'webadmin' user. In Permissions uncheck 'List contents' and 'Read all properties'. In the same menu, go down and confirm that the Properties -> 'Read all properties' option is not selected. Apply and Save all changes done. Test connection from FortiWeb using the 'test2' user.   Related articles: Technical Tip: How to configure FortiWeb Remote LDAP Adminstrators Technical Tip: How to configure a Remote LDAP Server and troubleshooting LDAP test connection