Radius providing AD groupmembership

[andygfunk]

I have a problem I was hoping to get some help with. First some background.

We use Securenvoy for two factor authentication. Securenvoy is a quite limited radius server. We want to allow users to log on to ssl vpn with securenvoy providen second factor, while we limit permissions in the policy set with other ldap groups. 

So the user is member of one group which makes securenvoy to authenticate the user, and also one or more AD groups which are supposed to grant access to different parts of the network. We are hoping there is a possibility to pass back the username from radius and use this to populate firewall ldap groups. I don't know if this is making sense, but I'll continue anyhow.

We have tried to to do this with RSSO, but we have 3 problems with this approach:

1. Securenvoy is a limited radius server and does not support multiple network policies

2. Using NPS to forward radius request to securenvoy works, but I cannot get the accounting to work.

3. How will this work with user being member of multiple ad groups?

Our other SSL VPN solution from juniper solves this by using both Radius and LDAP in the authorization process. First it authenticates with radius, then checks ldap for group membership. We were hoping to do much the same here with one group to allow access to a tunnel based portal, and ad groups in firewall policies to grant access to networks. We can still use juniper, but I would like to get ridd of it to keep operational complexity at a minimum.

Hopefully someone can shed some light on this, and tell me if it is possible or not. 

Best regards

Andreas Grumheden

[emnoc]

I think you can still do what the juniper does. ( I'm just throwing this out never done it this way )

1: setup a radius  auth server

2: define a local user with  the "set type radius"  to match the radius server from step#1

e.g

config user local

   edit emnoc

         set type radius

         set radius-server "blahblahblah"

end

Then set  the  group to match on the LDAP-group mapping

e.g

config user group         edit "RoadWarriorGrp1"         set member "ldapsrvr01"             config match                 edit 1                     set server-name "ldapsrvr01"                     set group-name "CN=RDWARl,CN=vpnusers,DC=1plus1eq2,DC=com"                 next             end     next

What that should do is to allow for the  the radius for 1st auth and then query the ldap-server for  group-name.

Not sure if 2nd factor is doable tho but the above should get you started in the right path.

[andygfunk]

Thank you for taking the time.

Sadly it does not seem to work. As soon as it hits the radius server it stops group matching:

[left]fnbamd_auth.c[2250] fnbamd_auth_handle_radius_result-Skipping group matching fnbamd_fsm.c[820] find_matched_usr_grps-Skipped group matching[/left]

I have so far only managed to radius authenticate with a firewall group, and not a user. When trying with a user I get fnbamd_framed_ip_delete_ip-Didn't delete IP 0.0.0.0; no IPs for vfid 4 which might be because of something I've done on the radius server.

Would it be possible to combine radius authentication with FSSO agent on the domain controllers?

[emnoc]

I never heard of that FSS0+RADIUS, I'm really surprised that the suggestion did not work. So if you set the the type as a local user and then auth does the group mapping works for the ldap query ?

Also did you do any diag test authserver  to see what happens.?

e.g

diag  test  authserver  radius <radius server> <username> < password>

And the same but a ldap-search query?

ken

[andygfunk]

Hi again,

No I'm guessing I FSSO agent needs the correct IP for the user mapping to work, and authentication happens before IP delegation. I tried changing the user account from radius to firewall type, and the result was that it does not seem to query any of the remote authentication servers. 

Basically this seems to be the behaviour:

If radius user/group are placed in the first policy (sequence) it checks radius, if success it stops group mapping

If ldap group are placed in the first policy (sequence) it checks ldap first, if success it stops group mapping 

If a local (firewall) user is configured with the username which I'm trying to log in with, it does not check any remote authentication methods.

Oc course ut might be me misunderstanding your suggestions, I will try to trim down the config file when I have the time and post it.

Right now my only hope seems to be RSSO and using a Microsoft NPS i between fortigate and securenvoy. Hopefully I can manage to create a network policy which sends some attributes back to fortigate and then manage to get the fortigate to do something usefull with that attribute.

If there are any other suggestion I aappreciate the effort, if not I think I will send a request for new feature in Fortinet's direction.

PS:

I forgot to mentions it but it is a 1500D HA cluster and running 5.2.4