Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Murali_S_L
New Contributor

AD & FSSO User authentication

Hi,

We have Fortinet 201E with LDAP configured. The web policy is configured based on user groups & AD is forwarding wrong user names to collector agent. Instead of logged in user, it is forwarding Domain\Administrator & the internet wont work for that user. We have upgraded the firmware to the latest & reinstalled latest FSSO agent. Still unable to resolve the issue. Request for help

Thanks in advance

Regards

Murali S L

1 Solution
xsilver_FTNT

So if I got it correctly then you do have regular user, logging into workstation, but FSSO took from DC that logged on user is Administrator.

That user simply logged into workstation (which is part of domain, joined properly) and did NOT run any app under another domain account. Haven't used 'RunAs..' windows feature. There is no background app/service running under Administrator privileges found on workstation. And user is still reported to domain as Administrator.

 

Use simple tools on workstation to check what is logged on user and which DC was used to verification.

Then check logons on DC in Windows Security log.

Compare to Collectoragent.log and FortiGate's FSSO records.

That, checked over time, or with test workstation logon when you do observe progress of that logon being processed, should show you where the issue starts.

B.2. Workstation’s output under affected user account ipconfig /all whoami ping -4 -n 2 %logonserver:~2% net use time /T date /T qwinsta sc query RemoteRegistry

 

B.3. on FortiGate collect output of those commands (log console output to text file, SSH connection preferred over direct console for its speed): get system stat diag debug reset diag debug en diag debug authd fsso server-status diag debug auth fsso list diag fire auth list diag wad user list

 

Above is part of debug commands set we use in TAC to check SSO. Hope those will help. If not, kindly open standard trouble ticket with TAC and one of us will help you to resolve the situation completely.

Tomas Stribrny - NASDAQ:FTNT - Fortinet Inc. - TAC Staff Engineer
AAA, MFA, VoIP and other Fortinet stuff

View solution in original post

6 REPLIES 6
xsilver_FTNT
Staff
Staff

Hi Murali,

set Collector log level to debug and have a look what users were processed from affected workstation name/IP.

Similar situation usually happens when there are background apps/agents/proxies on workstation, run under different or service accounts. As those need to authenticate to domain as well, their logon will overwrite logon made by user.

Use of 'RunAs..' also affect this.

If you do have some backend app run under administrator/service account then you can:

- change setup of that app to use some service account (could be admin group member, but not directly admin)

- add all those service accounts to Ignore List on Collector, so their logons will be completely ignored from processing and so they will stop overwriting regular user's FSSO records

 

Tomas Stribrny - NASDAQ:FTNT - Fortinet Inc. - TAC Staff Engineer
AAA, MFA, VoIP and other Fortinet stuff

Murali_S_L

Hi Tomas,

Thanks for the help. We have checked affected systems for any background apps running as administrator & nothing found. This is happening on more than 70 systems with mixed OS (Windows 10, 7 & XP as well).

 

Collector log level put to DEBUG, affected user host name & IP is correctly captured except user name. It is Domain\Administrator.

 

Added administrator account to ignore list & Internet doesn't work.

 

Thanks

Murali S L

Maciej

Hello, 

my problem with FSSO was that, if user logged in to computer and then to any internal app with AD credentials, this last logon was read as if domain controller was the last known source of authentication. 

 

This can be a similar case. 

 

This help : https://kb.fortinet.com/kb/php/search.do?cmd=displayKC&docType=kc&externalId=FD45566&sliceId=1&docTy... (Technical Tip: Excluding IP addresses from FSSO logon events)

Murali_S_L

Hi,

Apologies for the delayed response, thanks for the inputs. Will update shortly as we have opened a ticket with Fortinet

 

Regards

Murali S L

xsilver_FTNT

So if I got it correctly then you do have regular user, logging into workstation, but FSSO took from DC that logged on user is Administrator.

That user simply logged into workstation (which is part of domain, joined properly) and did NOT run any app under another domain account. Haven't used 'RunAs..' windows feature. There is no background app/service running under Administrator privileges found on workstation. And user is still reported to domain as Administrator.

 

Use simple tools on workstation to check what is logged on user and which DC was used to verification.

Then check logons on DC in Windows Security log.

Compare to Collectoragent.log and FortiGate's FSSO records.

That, checked over time, or with test workstation logon when you do observe progress of that logon being processed, should show you where the issue starts.

B.2. Workstation’s output under affected user account ipconfig /all whoami ping -4 -n 2 %logonserver:~2% net use time /T date /T qwinsta sc query RemoteRegistry

 

B.3. on FortiGate collect output of those commands (log console output to text file, SSH connection preferred over direct console for its speed): get system stat diag debug reset diag debug en diag debug authd fsso server-status diag debug auth fsso list diag fire auth list diag wad user list

 

Above is part of debug commands set we use in TAC to check SSO. Hope those will help. If not, kindly open standard trouble ticket with TAC and one of us will help you to resolve the situation completely.

Tomas Stribrny - NASDAQ:FTNT - Fortinet Inc. - TAC Staff Engineer
AAA, MFA, VoIP and other Fortinet stuff

Murali_S_L

Hi Tomas,

As suggested by you, we have opened a trouble ticket with fortinet & the same logs have been sought by the team.

Keep you updated once resolved.

Regards

Murali S L

 

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors