FAC - remote user synch w/ AD not pulling cert bindings for users

[doncacciatoconsuting]

Using FAC for Radius/EAP-TLS, backend is Active Directory.

My LDAP remote user synch rule seems to be working, except for the fact that my a user's certificate binding is not coming through. The user does have a cert issued.

Any ideas - misconfiguration on FAC or my domain controller ?

[sprashant]

Hello @doncacciatoconsuting 

You can follow below steps to check for any misconfiguration:

1. Verify Certificate Binding Configuration:
- Check the LDAP User Mapping Attributes in the remote user sync rule on FAC. Ensure that the Certificate binding common name is correctly set to dNSHostName.

2. Check Certificate Issuance:
- Validate that the user's certificate is correctly issued by the Certificate Authority (CA) and is valid.
- Ensure that the user's certificate includes the necessary attributes for binding, such as dNSHostName.

3. Review LDAP Configuration:
- Double-check the LDAP filter in the remote user sync rule to ensure it includes the necessary criteria to match the user with the certificate.
- Verify the LDAP settings on FAC to ensure proper connectivity and synchronization with Active Directory.

4. Test and Troubleshoot:
- Run a manual sync on the remote user sync rule to force the update and import of the user's information.
- Monitor the FAC logs for any errors or warnings related to the certificate binding process.

5. Collaboration with Domain Controller Team:
- Coordinate with your domain controller team to confirm the presence and correctness of the user's certificate attributes in Active Directory.
- Request assistance in checking the certificate issuance process and ensuring the necessary attributes are included.

For reference:

https://docs.fortinet.com/document/fortiauthenticator/6.6.0/examples/606570/importing-users-with-a-r...

https://docs.fortinet.com/document/fortiauthenticator/6.6.1/release-notes/713049/known-issues#Known_...

https://docs.fortinet.com/document/fortiauthenticator/6.6.0/administration-guide/215969/remote-user-...

https://docs.fortinet.com/document/fortiauthenticator/6.6.0/examples/863753/configuring-the-eap-serv...

https://docs.fortinet.com/document/fortiauthenticator/6.6.1/administration-guide/987701/remote-user-...

[ashishrathee]

With certificate binding in LDAP remote user sync for RADIUS/EAP-TLS authentication with Active Directory, follow these steps:

1. Verify that the Certificate binding common name in LDAP User Mapping Attributes is set to "dNSHostName" and matches the user's certificate CN attribute.

2. Ensure the LDAP filter correctly includes users with certificates.

3. Confirm the correct Certificate Authority (CA) is selected in the Certificate binding CA dropdown.

4. Run the user sync rule and check for errors or warnings.

5. Verify the user and certificate binding in FortiAuthenticator under Authentication > User Management > Remote Users.

6. Ensure the user's certificate is valid, not expired, and properly signed. These steps will help ensure proper certificate binding and user synchronization in FortiAuthenticator.

[doncacciatoconsuting]

Thanks all, I'm quite new to using the Domain Controller Cert service. 

Item #1 - I have dNSHostName set in the config. My user cert has these fields...CN=John Doe CN=Users DC=mydomain DC=com. I don't see "dNSHostName"

#2 - I am not using an LDAP filter at this point because I'm not quite sure how to configure it. I assume that no filter = ALL, right ?

#3 - CA is all good

#4 No warnings/error when I run the synch rule manually or on schedule

#5 This field is empty - so I added it manually and that seems to work

#6 - user cert is def good

The interesting thing is that I have a computer account that was synch'd and the proper cert binding was pulled.

ANy other ideas ?

[doncacciatoconsuting]

I'm not even so sure this matters, because my user still gets authenticated successfully..I'm using the Radius Policy of Trusted CAs rather than the Certificate Bindings. Does that make sense ?

[ebilcari · Accepted solution]

If Trusted CA(s) is chosen than only the certificate validation is checked, more information can be found here:

When the Authentication mode is set as Trusted CA(s), the RADIUS daemon ignores any configured certificate bindings and only verifies that the client certificate is:

• Signed by one of the trusted CAs

• Not expired

• Not revoked (if CRL is configured)