Hi,
Agentless FSSO login does not rely on LDAP for authentication.
LDAP is used for authorization and to know which group the user will be mapped.
First, configure the LDAP server which seems OK for you.
Second, create the agentless FSSO profile and choose the LDAP server you created just before.
Groups must be automatically populated from the FSSO agentless declaration page within the view/edit groups.
Once you got them, perform the user group association in the user > group menu.
Final configuration step, create the identity-based policy.
To troubleshoot,
In 5.0 with agentless FSSO, the correct CLI commands are:
diag debug fsso-polling user
diag debug fsso-polling detail
First thing is to be sure the Fortigate receive the logon information from the domain controllers:
diag deb app authd -1
diag deb app fssod -1
diag deb app smbcd -1
diag deb enable
// Generate a logon
Diag debug should include logon event related to the user that just logged-in. If you don' t see them, start checking that the account used to reach the domain controller is part of domain admin group (or at least is a member of the event log readers group if win2k8) and that Fortigate can reach the domain controller through tcp port 445. In any case, the previous diag commands should help to go forward.
Cheers