Access denied when connecting to SMB share

[cucciajm]

Have a Fortigate 600C. Have had VPN web portals sucessfully running for several months. Users can connect to SMB shares without issue. Set up a new server, Windows 2008 R2, set up some shares. When attempting to authenticate to shares on the new box, access is denied unless the domain name is entered before the username; When domain\username is entered into the username field, it goes through fine. Not a huge issue; problem is that we' re moving shares off of an old server onto this new one. Users are not used to typing in domain\ before their username. I was hoping to have it operate the same way when they connected to their same SMB shares on the new box. I don' t think it is an NTFS or sharing permissions issue. One other difference is that the old server is an AD controller. The new one is not and I was trying to avoid making it a controller if at all possible. Thanks in advance for the help. JM

[cucciajm]

After I tested this with a couple other servers in the enterprise -- some that were AD controllers and others that weren' t -- a pattern quickly developed: if it' s an AD controller, you don' t have to enter the domain in front of the username. If it' s not a controller, you have to add the domain. If anyone knows why this is, I am interested. Perhaps I am just forgetting something basic about the way authentication works.

[svacs]

Hi cucciajm, I looked into this issue about a month back when I was setting up SMBs to use SSO and came to the same conclusion. If you create an SMB share on a DC, no domain is required to be specified (e.g. You don' t need to use Alternate SSO credentials that need to be setup by each of your users manually if you' re trying to map My Documents). The reason why you need to specify the domain is during the authentication phase the FortiGate device by default sends NT\username. NT\username is a " local only" lookup, and as your DC contains the users for your forest/domain it is able to authenticate. When you have the SMB share on a non-DC server it does not have the AD user accounts stored on it so it does not work. If you create a local user account on the server where the SMB is stored though, you can access it as normal, but this is pointless in a domain environment. The only way to get this fixed is if Fortinet implements a default domain parameter that can be enabled and disabled on a per bookmark basis (for those with multiple domains). I' ve been meaning to contact someone about it but I have not gotten around to it yet. I hope this sheds some light on the issue for you.

[fjansson]

Old post, but in case someone else has the same issues. Do the following:

(Tested on v5.2.4,build688)

#config vpn ssl settings  set dns-suffix domain.local

#config vpn ssl settings  set dns-suffix domain.local   Then, navigate to the relevant bookmark and select SSO: auto   Also, make sure the file share you are entering is not a DFS share, as this will not work (at least when I tried it).

Kind regards, Frida