Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
mbeyaz
New Contributor

1200D Two Factor Auth

Hi,

I used my 1200D with LDAP auth SSLVPN, I need activate two factor auth my device but fortigate cant fetch email address in LDAP server. How can I add automatic add/fetch email address my users for two factor auth?

 

Thanks,

3 REPLIES 3
xsilver_FTNT
Staff
Staff

Hi,

from your need for email address, 2FA and FortiGate, I guess you are talking about FortiToken Mobile.

 

FortiGate is not designed as complete authentication center. And therefore 2FA tokens are bonded to locally defined, regardless they are type remote, "locally defined" because tokens are set on FortiGate and bonded to users _on_ FortiGate.

The FortiGate is unable to automatically synchronize users from LDAP, none of their properties, including email addresses. Nor assign tokens to them. And therefore token assignment and required email address needs to be set manually by admin.

 

If you do have tens, or small hundreds of users, then it will be a bit laborious. FortiGate does have CLI, plain text config .. use scripts to automate this process.

 

If you do have bigger environment, hundreds of users, users moving in and out of the organization, changing their positions/group-membership. Then I would suggest to start thinking about FortiAuthenticator, which is authentication/authorization concentric platform.

It is capable of ..  - automatic user synchronization from LDAP according to defined LDAP filters, in defined time cycles

- automatic group assignment and RADIUS AVP parameters setup according to sync rules, later usable for multiple auth clients like FortiGates, FortiAPs, or even 3rd party RADIUS capable devices like routers, switches, 802.1x...

- automatic token provision from those sync rules, and so email retrieval from configurable LDAP field - users removed from LDAP, not matching filters anymore can be removed and tokens reclaimed back to pool

- token self service portal available, to report lost token or re-provision token to new/replacement mobile device

- usage enforcement, captive portals, guest management, Single Sign-on (SSO) .. 

... and lot lot more!

 

Hope this helped to get an idea.

Tomas Stribrny - NASDAQ:FTNT - Fortinet Inc. - TAC Staff Engineer
AAA, MFA, VoIP and other Fortinet stuff

mbeyaz
New Contributor

I wrote also reddit fortigate page message is here

 

It would roughly boil down to something like (pseudocode):

ad_users = query_ad(mydomain) for user in ad_user: fgt.api.post(/user/local/).body({ ‘name’: user[‘sAMAccountName’], ‘type’: ‘ldap’, ‘two-factor’: ‘email’, ‘email-to’: user[‘smtp’] })

 

how can I use this pseudocore? I think fgt.api required but I dont find any resources for usage.

xsilver_FTNT

FortiGate API is AFAIK documented only on Fortinet Developer Network.

If you are not a member, no API.

But sure you can use bash/python/perl/rust .. whatever to access SSH and commit commands as if you would be on CLI.

PowerShell to Get-User-stuff from AD or LDAP query .. or some export from AD to CVS textfile and parse via bash+awk :)

There is almost infinite amount of possibilities how to make it. In case you do not have FortiAuthenticator which would do it for you.

Tomas Stribrny - NASDAQ:FTNT - Fortinet Inc. - TAC Staff Engineer
AAA, MFA, VoIP and other Fortinet stuff

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors