Active Directory Authenticaton with Groups (LDAP)

[#1]

Active Directory Authentication I' ve had a rough couple of days parsing through documentation trying to figure out how to get my Fortigate 100A router to use Active Directory 2003 for IPSec VPN authentication. This tutorial is the result. It results in a very clean setup that allows an administrator to allow/disallow VPN access based on Security Group membership in AD. This configuration should also work for any other type of access control, such as SSL-VPN or Web authentication. Create a Security group in AD, I called mine " VPN Users" Add any users to this group that will need VPN access. Create a User in AD, mine is named " Fortigate" . This user MUST be located in the root of the tree containing user accounts. The fortigate router will only try to authenticate clients that are located in the same OU, or a sub-OU of this user! The following configuration can only be configured using the CLI. This is because the " group" tag is not available in the web interface. (This at least holds true in 3.0 MR6 Patch 2) If you are not already familiar with FortiIOS, now is a good time to learn. You could also just log in and type the following commands, but do so at your own risk. Please read all my comments below before doing this part. config user ldap edit " <LDAP NAME>" set server " dc.example.com" set cnid " sAMAccountName" set dn " OU=People,DC=example,DC=com" set type regular set username " Fortigate" set password ENC <Fortigate' s Password> set group " CN=VPN Users,OU=People,DC=example,DC=com" set filter " (&(objectCategory=CN=Group,CN=Schema,CN=Configuration,DC=example,DC=com)(member=*))" next end server = IP address or DNS name for the domain controller to authenticate against. type = The type of LDAP authentication to be done. regular is the only one that can do Auth->Search->Auth->Group Verification username = The username that will initially authenticate against LDAP. (NOTE: Must be located in the root of the " dn" ) In other words, when the router tries to login, it will try DN prepended by username as the LDAP User! password = Password for the username dn = This is the Distinguished Name where where the Fortinet does everything. This serves 2 purposes. 1) This is where the username is located in LDAP 2) This is the base of searching for ALL USERS THAT WILL TRY TO AUTHENTICATE! cnid = The username that the client tries to authenticate will be matched against this. I chose the sAMAccountName, which is the Windows Logon Account. You could also choose to use the displayName, userPrincipalName, or any other LDAP attribute you choose. group = This is the DN of the group that the user MUST belong to in order to login. Note: Full LDAP Path Required. (Does this need to be in the DN tree? I don' t believe so, can someone verify?) filter = Once the group is found, it' s list of members is found using this query, which is ran against the group object itself. So, the above line first makes sure that the group is actually an AD Security Group, and then gets the list of all members. If the user trying to authenticate is in the list, access is granted, otherwise access is denied. Well, I hope you enjoyed this write-up, it was painful but fun! With any luck, you will find this helpful and avoid needing too much asprin. :-) Cheers!

[generaltab]

Hello, I' ll be attempting this AD auth for SSL-VPN users as you' ve described here. Would you expect the following to work? --- config user ldap edit " <LDAP NAME>" set server " server.aliquot.com" set cnid " sAMAccountName" set dn " OU=Aliquot-Users,DC=aliquot,DC=local" set type regular set username " Fortigate" set password ENC <jk96gJ76> set group " CN=VPN Users,OU=Aliquot-Users,DC=aliquot,DC=local" set filter " (&(objectCategory=CN=Group,CN=Schema,CN=Configuration,DC=aliquot,DC=local)(member=*))" next end --- AD looks like this:

AD Users and Computers
   aliquot.local
     Aliquot-Users      <-- Fortigate ' user'  is in here
     Builtin
     Computers
     Domain Controllers
     Users                 <-- VPN Users group is in here

Thanks for your help! Steve

[laf]

I won' t expect to work, as the VPN User Group is not located in the Aliqout-Users OU.

[generaltab]

Thanks, laf. Does the VPN User Group need to be there, or can I change the group line instead? Is FSAE needed for this? --Steve

[laf]

I suggest you this one: config user ldap edit " <LDAP NAME>" set server " use an IP address instead of the server' s name" set cnid " sAMAccountName" set dn " CN=Users,DC=aliquot,DC=local" set type regular set username " Fortigate" set password ENC <jk96gJ76> set group " CN=VPN Users,CN=Users,DC=aliquot,DC=local" set filter " (&(objectCategory=CN=Group,CN=Schema,CN=Configuration,DC=aliquot,DC=local)(member=*))" next end and this way you keep your users in the existing, builtin CN Users, and the same for VPN User group. Also there s no need of FSAE installing on server ! Keep in mind to test it: diagnose test authserver ldap <server_name> <username> <password>

[generaltab]

Thanks again. With the following, can I keep my Aliquot-Users OU for my " real users" , such as S0crates has a " People" OU apart from the system accounts in the " Users" container? config user ldap edit " <LDAP NAME>" set server " 192.168.1.1" set cnid " sAMAccountName" set dn " CN=Users,DC=aliquot,DC=local" set type regular set username " Fortigate" set password ENC <jk96gJ76> set group " CN=VPN Users,CN=Users,DC=aliquot,DC=local" set filter " (&(objectCategory=CN=Group,CN=Schema,CN=Configuration,DC=aliquot,DC=local)(member=*))" next end

[laf]

So where are the users who need to connect to the VPN: Aliqout - Users or in Users ? If both are of interest you ll create two ldap users, with two config for each Container and then add this two users to the SSL VPN group.

[generaltab]

The users who need to connect to the VPN are in " Aliquot-Users" , but the security group that grants them VPN access is in the " Users" container. I' d like to keep my user accounts in Aliquot-Users.

[generaltab]

I guess if I have 1) my user accounts (People), 2) the Fortigate " user" , and 3) the " VPN Users" security group *all* under the Aliquot-Users OU, the below should work: config user ldap edit " <LDAP NAME>" set server " server.aliquot.local" set cnid " sAMAccountName" set dn " OU=Aliquot-Users,DC=aliquot,DC=local" set type regular set username " Fortigate" set password ENC <jk96gJ76> set group " CN=VPN Users,OU=Aliquot-Users,DC=aliquot,DC=local" set filter " (&(objectCategory=CN=Group,CN=Schema,CN=Configuration,DC=aliquot,DC=local)(member=*))" next end

[laf]

You' re right; that' s logical; create VPN User in Aliqout-Users and it should work at once.

[generaltab]

Hi, I got to line 2 of the above before getting an error.. Connected baxter # config user ldap baxter (ldap) # edit " <LDAP NAME>" The string contains XSS vulnerability characters value parse error before ' <LDAP NAME>' Command fail. Return code -173