Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
doncacciatoconsuting
New Contributor III

FAC - remote user synch w/ AD not pulling cert bindings for users

Using FAC for Radius/EAP-TLS, backend is Active Directory.

 

My LDAP remote user synch rule seems to be working, except for the fact that my a user's certificate binding is not coming through. The user does have a cert issued.

 

Any ideas - misconfiguration on FAC or my domain controller ?

1 Solution
ebilcari

If Trusted CA(s) is chosen than only the certificate validation is checked, more information can be found here:

When the Authentication mode is set as Trusted CA(s), the RADIUS daemon ignores any configured certificate bindings and only verifies that the client certificate is:

  • Signed by one of the trusted CAs

  • Not expired

  • Not revoked (if CRL is configured)

- Emirjon
If you have found a solution, please like and accept it to make it easily accessible for others.

View solution in original post

5 REPLIES 5
sprashant
Staff
Staff

Hello @doncacciatoconsuting 

 

You can follow below steps to check for any misconfiguration:

 

1. Verify Certificate Binding Configuration:
- Check the LDAP User Mapping Attributes in the remote user sync rule on FAC. Ensure that the Certificate binding common name is correctly set to dNSHostName.

2. Check Certificate Issuance:
- Validate that the user's certificate is correctly issued by the Certificate Authority (CA) and is valid.
- Ensure that the user's certificate includes the necessary attributes for binding, such as dNSHostName.

 

3. Review LDAP Configuration:
- Double-check the LDAP filter in the remote user sync rule to ensure it includes the necessary criteria to match the user with the certificate.
- Verify the LDAP settings on FAC to ensure proper connectivity and synchronization with Active Directory.

 


4. Test and Troubleshoot:
- Run a manual sync on the remote user sync rule to force the update and import of the user's information.
- Monitor the FAC logs for any errors or warnings related to the certificate binding process.

5. Collaboration with Domain Controller Team:
- Coordinate with your domain controller team to confirm the presence and correctness of the user's certificate attributes in Active Directory.
- Request assistance in checking the certificate issuance process and ensuring the necessary attributes are included.

 

For reference:

https://docs.fortinet.com/document/fortiauthenticator/6.6.0/examples/606570/importing-users-with-a-r...

https://docs.fortinet.com/document/fortiauthenticator/6.6.1/release-notes/713049/known-issues#Known_...

https://docs.fortinet.com/document/fortiauthenticator/6.6.0/administration-guide/215969/remote-user-...

https://docs.fortinet.com/document/fortiauthenticator/6.6.0/examples/863753/configuring-the-eap-serv...

https://docs.fortinet.com/document/fortiauthenticator/6.6.1/administration-guide/987701/remote-user-...

 

 

Sprashant
ashishrathee
Staff
Staff

With certificate binding in LDAP remote user sync for RADIUS/EAP-TLS authentication with Active Directory, follow these steps:

1. Verify that the Certificate binding common name in LDAP User Mapping Attributes is set to "dNSHostName" and matches the user's certificate CN attribute.

2. Ensure the LDAP filter correctly includes users with certificates.

3. Confirm the correct Certificate Authority (CA) is selected in the Certificate binding CA dropdown.

4. Run the user sync rule and check for errors or warnings.

5. Verify the user and certificate binding in FortiAuthenticator under Authentication > User Management > Remote Users.

6. Ensure the user's certificate is valid, not expired, and properly signed. These steps will help ensure proper certificate binding and user synchronization in FortiAuthenticator.

doncacciatoconsuting
New Contributor III

Thanks all, I'm quite new to using the Domain Controller Cert service. 

 

Item #1 - I have dNSHostName set in the config. My user cert has these fields...CN=John Doe CN=Users DC=mydomain DC=com. I don't see "dNSHostName"

#2 - I am not using an LDAP filter at this point because I'm not quite sure how to configure it. I assume that no filter = ALL, right ?

#3 - CA is all good

#4 No warnings/error when I run the synch rule manually or on schedule

#5 This field is empty - so I added it manually and that seems to work

#6 - user cert is def good

 

The interesting thing is that I have a computer account that was synch'd and the proper cert binding was pulled.

 

ANy other ideas ?

doncacciatoconsuting
New Contributor III

I'm not even so sure this matters, because my user still gets authenticated successfully..I'm using the Radius Policy of Trusted CAs rather than the Certificate Bindings. Does that make sense ?

ebilcari

If Trusted CA(s) is chosen than only the certificate validation is checked, more information can be found here:

When the Authentication mode is set as Trusted CA(s), the RADIUS daemon ignores any configured certificate bindings and only verifies that the client certificate is:

  • Signed by one of the trusted CAs

  • Not expired

  • Not revoked (if CRL is configured)

- Emirjon
If you have found a solution, please like and accept it to make it easily accessible for others.
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors