AD & FSSO User authentication

[Murali_S_L]

Hi,

We have Fortinet 201E with LDAP configured. The web policy is configured based on user groups & AD is forwarding wrong user names to collector agent. Instead of logged in user, it is forwarding Domain\Administrator & the internet wont work for that user. We have upgraded the firmware to the latest & reinstalled latest FSSO agent. Still unable to resolve the issue. Request for help

Thanks in advance

Regards

Murali S L

[xsilver_FTNT]

Hi Murali,

set Collector log level to debug and have a look what users were processed from affected workstation name/IP.

Similar situation usually happens when there are background apps/agents/proxies on workstation, run under different or service accounts. As those need to authenticate to domain as well, their logon will overwrite logon made by user.

Use of 'RunAs..' also affect this.

If you do have some backend app run under administrator/service account then you can:

- change setup of that app to use some service account (could be admin group member, but not directly admin)

- add all those service accounts to Ignore List on Collector, so their logons will be completely ignored from processing and so they will stop overwriting regular user's FSSO records

[Murali_S_L]

Hi Tomas,

Thanks for the help. We have checked affected systems for any background apps running as administrator & nothing found. This is happening on more than 70 systems with mixed OS (Windows 10, 7 & XP as well).

Collector log level put to DEBUG, affected user host name & IP is correctly captured except user name. It is Domain\Administrator.

Added administrator account to ignore list & Internet doesn't work.

Thanks

Murali S L

[Maciej]

Hello, 

my problem with FSSO was that, if user logged in to computer and then to any internal app with AD credentials, this last logon was read as if domain controller was the last known source of authentication. 

This can be a similar case. 

This help : https://kb.fortinet.com/kb/php/search.do?cmd=displayKC&docType=kc&externalId=FD45566&sliceId=1&docTy... (Technical Tip: Excluding IP addresses from FSSO logon events)

[Murali_S_L]

Hi,

Apologies for the delayed response, thanks for the inputs. Will update shortly as we have opened a ticket with Fortinet

Regards

Murali S L

[xsilver_FTNT · Accepted solution]

So if I got it correctly then you do have regular user, logging into workstation, but FSSO took from DC that logged on user is Administrator.

That user simply logged into workstation (which is part of domain, joined properly) and did NOT run any app under another domain account. Haven't used 'RunAs..' windows feature. There is no background app/service running under Administrator privileges found on workstation. And user is still reported to domain as Administrator.

Use simple tools on workstation to check what is logged on user and which DC was used to verification.

Then check logons on DC in Windows Security log.

Compare to Collectoragent.log and FortiGate's FSSO records.

That, checked over time, or with test workstation logon when you do observe progress of that logon being processed, should show you where the issue starts.

B.2. Workstation’s output under affected user account ipconfig /all whoami ping -4 -n 2 %logonserver:~2% net use time /T date /T qwinsta sc query RemoteRegistry

B.3. on FortiGate collect output of those commands (log console output to text file, SSH connection preferred over direct console for its speed): get system stat diag debug reset diag debug en diag debug authd fsso server-status diag debug auth fsso list diag fire auth list diag wad user list

Above is part of debug commands set we use in TAC to check SSO. Hope those will help. If not, kindly open standard trouble ticket with TAC and one of us will help you to resolve the situation completely.

[Murali_S_L]

Hi Tomas,

As suggested by you, we have opened a trouble ticket with fortinet & the same logs have been sought by the team.

Keep you updated once resolved.

Regards

Murali S L