Does SOCKS proxy support Form based authentication?

[Potato]

Dear all,

I just read this KB

https://docs.fortinet.com/document/fortigate/7.6.0/new-features/634909/socks-proxy-supports-utm-scan...

, and it looks good to my operation.

So I tried to set up one Evaluation Fortigate and see if Form-based Auth is also supported.

But seems no luck here.

The Form-based auth only appeared when I selected HTTP protocol.

If I selected Socks. No luck then.

Is there any way to achieve Captive portal + Local User DB + Socks-based proxy Auth on Fortigate?

[Jean-Philippe_P]

Hello Potato, 

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible. 

Thanks, 

[Jean-Philippe_P]

Hello,

We are still looking for an answer to your question.

We will come back to you ASAP.

[jintrah_FTNT]

Dear Potato,

The idea of achieving form based authentication using socks sounds better but I guess its not possible. We must understand how the underlying protocol works.

Socks is functioning at layer4 while form based authentication at layer7. Again, when implementing socks authentication defined in rfc 1928 (https://datatracker.ietf.org/doc/html/rfc1928) , the acceptable methods defined in protocol are below,

-----------------------------------------------------------------------------------

 The values currently defined for METHOD are:

          o  X'00' NO AUTHENTICATION REQUIRED
          o  X'01' GSSAPI
          o  X'02' USERNAME/PASSWORD
          o  X'03' to X'7F' IANA ASSIGNED
          o  X'80' to X'FE' RESERVED FOR PRIVATE METHODS
          o  X'FF' NO ACCEPTABLE METHODS

   Compliant implementations MUST support GSSAPI and SHOULD support
   USERNAME/PASSWORD authentication methods.

------------------------------------------------------------------------------------------------

So if socks proxy has to authenticate the socks client, the username/password would have been supplied already by the client over the socks connection it attempted (so no need for or thoughts for different auth methods if socks is solely used by the client). Also, if no authentication required was chosen by the socks client, and on FortiGate we enabled socks authentication, the connection terminates failing authentication.

Best regards,

Jin