I'm working on a lab with a Windows 2012R2 and a Fortigate VM64-KVM (trial version) running version 6 (tried 5.6 as well).
When adding the LDAP server to the Fortigate, I always get error LDAP_-5 in red. And I can't get to query against it.
When I debug, I can authenticate against it:
FortiGate-VM64-KVM # diagnose test authserver ldap "LDAP DC-01" user1 testpassword
authenticate 'user1' against 'LDAP DC-01' succeeded!
Group membership(s) - CN=Domain Admins,CN=Users,DC=fgtad,DC=local
config user ldap
edit "LDAP DC-01"
set server "10.10.10.11"
set cnid "cn"
set dn "dc=fgtad,dc=local"
set type regular
set username "LDAPconnect"
set password ENC ceUtrzALEk7sWZhJjrw1JElXiACZiRxwHScw9Spf2i2Fmr/FGSis8dpC0JyAuuAya/kZ91ECVenukLlLy8xfFyfJZ6hGqheLG5PCIhjVF8aLQxaeWlb8XnPJvR/ZBSIArzHDq+bD34X9fuUO0oraXOJbhOZfshPzCpZzvgJT04fVKhvWtZ3A56yCmgS2VjSVmMh45g==
This looks to be a bug that hits various versions of FortiOS at various times.
We found that it was only hitting FortiGates that had reasonably high latency between the FortiGate & the LDAP Server.
The fix for us was to change the 'remoteauthtimeout' value under 'config system global'.
The default is 5 seconds. We changed ours to 30.
After that, the process of checking status & 'test user credentials' takes a LONG time in the GUI, but works & we get green ticks all the way now.
As a side note, this seems to only impact the GUI. If you run a test from the CLI, it works almost instantly.
Before resolving the issue in the GUI with the timeout change, we configured the LDAP server, user group, etc. via the CLI. LDAP authentication worked without issue. We used it for VPN & Administrator authentication successfully - all prior to making the change to remoteauthtimeout. The remoteauthtimeout change resolved the GUI issue only.
config system global
set remoteauthtimeout 30
Forgot to mention the devices in question were running 6.2.4. at the time.
Also forgot to mention that changing the password & re-configuring the LDAP Server in the FortiGate made no difference. It was only the timeout value change that fixed the GUI problem for us.