Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
ephemeric
New Contributor II

Admin PKI 2FA Login

Hi,

 

We have created PKI users: robert, dhyata and rivaan with 2FA enabled.

We have created Administrators: robert_pki, dhyata_pki and rivaan_pki of type "Use public key infrastructure (PKI) group".

All PKI users are members of PKI group.

 

When I login (robert_pki), the browser asks to select cert and the login dialogue box is presented with the "User Name" field filled in with "robert_pki". I enter my 2FA password and login. That's all good.

 

However, when another user trys to login, using their cert in their browser, their login dialogue box when presented, already has "robert_pki" as "User name" filled in and greyed out and hence 2FA does not work for them.

 

If I delete robert_pki and login with 2FA dhyata_pki, it works. I create robert_pki and proceed to login with myself and see "dhyata_pki" as "User name" filled in and greyed out and hence 2FA does not work.

 

Tried from different workstations and hence different browsers.

 

I'm stumped.

Please help.

 

FortiOS 5.4.4 build 6003 (GA) on a FortiGate 101E.

 

Thank you.

 

 

1 Solution
emnoc
Esteemed Contributor III

It could be, I play around with this on  numerous browsers and   even in FML and the browsers all cache items differently. If you want to PoC use "curl" and simple web-auth and avoid the browser-types.

 

This might help also ; http://socpuppet.blogspot.com/2017/06/mfa-using-certficates-fortios-sys-admin.html

 

and

http://socpuppet.blogspot.com/2018/05/how-to-check-client-certificate-tls.html

 

FWIW: I have a FGT60D on 5.4.56 and do not see any problems   using  Safari or Firefox ( i'm a mac user btw ). So if you have access to  5.4.6, upgrade and restest. V6.0 also works perfectly  btw

 

Ken

PCNSE 

NSE 

StrongSwan  

View solution in original post

PCNSE NSE StrongSwan
7 REPLIES 7
tanr
Valued Contributor II

I'm not sure if the PKI group setup could be part of the problem, but there was at least one rather bad bug in 5.4.4 (Bug ID: 412987) related to how the certificates were looked at by the FortiGate.  See https://forum.fortinet.com/tm.aspx?m=142712 for a discussion of it.

 

That bug was fixed in 5.4.5, so you might want to try 5.4.5, or move up to the more recent 5.4.9 or 5.4.10.

emnoc
Esteemed Contributor III

I just did a write up on this 

 

http://socpuppet.blogspot.com/2018/05/securing-fortigate-https-admin-with-pki.html

 

 

what I  have  observed over a few years now; " The client web-browser type" plays a lot in the behavior for Certificate   and PKI for the admin interface. Have you tried MSIE, CHROME  , Safari and FF

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
tanr
Valued Contributor II

Hi Ken, nice write up. 

 

It looks like from your example the user name, CN on the certificate, and CN set in the PKI object all need to match?  The bug 412987 with 5.4.4 I ran into involved some cases where the FortiGate was not correctly matching the CN of the cert with the PKI -- don't know if that could be part of this issue or not.

ephemeric
New Contributor II

@tanr: that link you posted deals with IPsec VPN, I don't see the connection?

@emnoc: great writeup and very helpful but 2FA is working, at least for one user and yes, we have tried several browsers.

 

The issue seems to be that the last successfully authenticated PKI peer, is displayed in the next users browser regardless of different cert etc.

 

Thank you for all the responses.

 

emnoc
Esteemed Contributor III

It could be, I play around with this on  numerous browsers and   even in FML and the browsers all cache items differently. If you want to PoC use "curl" and simple web-auth and avoid the browser-types.

 

This might help also ; http://socpuppet.blogspot.com/2017/06/mfa-using-certficates-fortios-sys-admin.html

 

and

http://socpuppet.blogspot.com/2018/05/how-to-check-client-certificate-tls.html

 

FWIW: I have a FGT60D on 5.4.56 and do not see any problems   using  Safari or Firefox ( i'm a mac user btw ). So if you have access to  5.4.6, upgrade and restest. V6.0 also works perfectly  btw

 

Ken

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
ephemeric
New Contributor II

@emnoc: thank you sir. Will test and upgrade, great info. Cheers.

ephemeric
New Contributor II

Hi,

 

So I tested and noticed "<input type="text" name="username" id="username" value="dhyata_pki" readonly />" is wrong. "dhyata.pki" should be "robert_pki".

 

robert@anomaly ~/files % curl -u robert_pki --key robert_pki.key --cert robert_pki.crt --cacert ca.crt https://fortigate.gsoc.co...bsp;      Enter host password for user 'robert_pki':

<!DOCTYPE html> <html class="main-app"> <head> <meta http-equiv="X-UA-Compatible" content="IE=8; IE=EDGE"> <meta http-equiv="pragma" content="no-cache"> <meta name="viewport" content="width=device-width, initial-scale=1"><link href="/82cf4c38bb25fb93045faa670fb2741c/css/jquery.ui.css" rel="stylesheet" type="text/css"> <link href="/82cf4c38bb25fb93045faa670fb2741c/css/main-green.css" rel="stylesheet" type="text/css"> <script type='text/javascript' src='/82cf4c38bb25fb93045faa670fb2741c/lang/en.js'></script> <script language="JavaScript"> if (top.location != window.location) top.location.reload(); if (window.opener) {window.opener.top.location.reload(); self.close();} </script> </head> <body> <div class="view-container"> <form class="prompt" onsubmit="return false;" method="get" name="login" autocomplete="off"> <div class="content with-header"> <div class="header"> <f-icon class="ftnt-fortinet-grid icon-xl"></f-icon></div> <div class="sub-content"><div class="wide-inputs"> <div class="error-message" id="err_msg_txt"></div> <input type="text" name="username" id="username" value="dhyata_pki" readonly /> <input type=password autocomplete="off" name="secretkey" id="secretkey" placeholder="Password"> <input type=hidden name="auth_two_factor" id="auth_two_factor" value="1"> <input type=hidden name="auth_token" id="auth_token" value="Era=1&Payload=JWckYDQSfxpNO9V8+luZ49fUNP9mN/JXcH6qIhYwzHo= &AuthHash=VPzntXhDGki8ZGKPw3CSqtfe74kA "> <label id="token_msg" style="display: none;"></label> <input type="password" autocomplete="off" name="token_code"placeholder="Token Code" id="token_code" maxlength="16" style="display: none" disabled> </div> <div class="button-actions wide"> <button class="primary" name="login_button" id="login_button" type="button"onclick="try_login();" >Login</button> </div></div></div></form></div> <script type="text/javascript" src="/82cf4c38bb25fb93045faa670fb2741c/js/login.js"></script> <script language="Javascript"> document.onkeydown = key_pressdown; document.forms[0].secretkey.focus(); </script> </body> </html>

 

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors