Forti Client EMS + LDAP SAMBA

[tomeks]

With Forti Client 7.2.x the connection to LDAP Samba stopped working. From the conversations I have with Fortinet within tickets it seems that they do not intend to fix it. They always refer me to the NFR department. Do you have any solution for this problem? Do we have to slowly prepare to replace FortiClient with some other system?

[spoojary]

Hello I came across thsi reddit post : https://www.reddit.com/r/sysadmin/comments/16d6p1q/forticlient_ems_not_working_with_samba_ad_dc/

[tomeks]

I know this thread. But it ended without solving the problem.

[tomeks]

So I have another side question. Does anyone still use Samba as AD?

[spoojary]

Honestly, it has been a long time I have not seen anyone use it.

[informatiquejoskin]

There is still no-one who managed to solve this ?

Nicolas

[tomeks]

Unfortunately I was not able to solve this. I did tests using WireShark and noticed that ldap drops the connection as soon as FortiClient 7.2.x sends the packet "NTLM Message Type: NTLMSSP_NEGOTIATE (1)" version 7.0.x logged in sending "NTLM Message Type: sasl (3)"

Fortinet technical support has given me to understand that they will not do this.

I also led discussions on Samba mailing but without result.

[2024/11/05 14:19:11.123630, 3] source4/samba/ service_stream.c:67(stream_terminate_connection)
stream_terminate_connection: Terminating connection - 'ldapsrv_call_loop: tstream_read_pdu_blob_recv() - NT_STATUS_CONNECTION_RESET'
[2024/11/05 14:19:11.124440, 3] source4/samba/ service_stream.c:67(stream_terminate_connection)
stream_terminate_connection: Terminating connection - 'LDAP_PROTOCOL_ERROR'

When Ems 7.2.x logs in it observes in the Samba logs:

[bwesleyNRG]

This looks like a very similar problem I struck with using Samba AD authentication for ForiOS after 7.4.4. They hardened the certificate checking requirements for LDAPS and now require the CA signing the certificate on the Samba server to be trusted. I had to import the CA certificate into the Fortigate LDAP config and it fixed the problem.

Here is a Forum post regarding it.
https://community.fortinet.com/t5/Support-Forum/LDAP-authentication-for-admins-not-working-after-For...

[tomeks]

The problem with Fortigate is completely different—indeed, it is enough to upload the certificate. In the case of EMS, the issue concerns LDAP protocol support by EMS.

[bwesleyNRG]

After posting the last reply I did actually try and setup Active Directory in EMS 7.4 with a Samba based DC. This samba dc is currently in production with a Fortigate successfully using it for authentication.  However with EMS it would not work. It was returning en EOF read error. In doing a package trace of the LDAPS handshake it was failing. After sending the initial Hello message. Something around the TLS handshake seems to be the issue. It did work with our Microsoft based DC.  This is very frustrating as we are currently evaluating EMS ZTNA and vpn. I was going to raise a TAC case tomorrow.