1200D Two Factor Auth

[mbeyaz]

Hi,

I used my 1200D with LDAP auth SSLVPN, I need activate two factor auth my device but fortigate cant fetch email address in LDAP server. How can I add automatic add/fetch email address my users for two factor auth?

Thanks,

[xsilver_FTNT]

Hi,

from your need for email address, 2FA and FortiGate, I guess you are talking about FortiToken Mobile.

FortiGate is not designed as complete authentication center. And therefore 2FA tokens are bonded to locally defined, regardless they are type remote, "locally defined" because tokens are set on FortiGate and bonded to users _on_ FortiGate.

The FortiGate is unable to automatically synchronize users from LDAP, none of their properties, including email addresses. Nor assign tokens to them. And therefore token assignment and required email address needs to be set manually by admin.

If you do have tens, or small hundreds of users, then it will be a bit laborious. FortiGate does have CLI, plain text config .. use scripts to automate this process.

If you do have bigger environment, hundreds of users, users moving in and out of the organization, changing their positions/group-membership. Then I would suggest to start thinking about FortiAuthenticator, which is authentication/authorization concentric platform.

It is capable of ..  - automatic user synchronization from LDAP according to defined LDAP filters, in defined time cycles

- automatic group assignment and RADIUS AVP parameters setup according to sync rules, later usable for multiple auth clients like FortiGates, FortiAPs, or even 3rd party RADIUS capable devices like routers, switches, 802.1x...

- automatic token provision from those sync rules, and so email retrieval from configurable LDAP field - users removed from LDAP, not matching filters anymore can be removed and tokens reclaimed back to pool

- token self service portal available, to report lost token or re-provision token to new/replacement mobile device

- usage enforcement, captive portals, guest management, Single Sign-on (SSO) .. 

... and lot lot more!

Hope this helped to get an idea.

[mbeyaz]

I wrote also reddit fortigate page message is here

It would roughly boil down to something like (pseudocode):

ad_users = query_ad(mydomain) for user in ad_user: fgt.api.post(/user/local/).body({ ‘name’: user[‘sAMAccountName’], ‘type’: ‘ldap’, ‘two-factor’: ‘email’, ‘email-to’: user[‘smtp’] })

how can I use this pseudocore? I think fgt.api required but I dont find any resources for usage.

[xsilver_FTNT]

FortiGate API is AFAIK documented only on Fortinet Developer Network.

If you are not a member, no API.

But sure you can use bash/python/perl/rust .. whatever to access SSH and commit commands as if you would be on CLI.

PowerShell to Get-User-stuff from AD or LDAP query .. or some export from AD to CVS textfile and parse via bash+awk :)

There is almost infinite amount of possibilities how to make it. In case you do not have FortiAuthenticator which would do it for you.