FortiAuthenticator as intermediate LDAP for Corp LDAP

[AEK]

Hello FAC admins

I'm working on FAC 6.6.2.

I noticed that FAC's local LDAP can be used only for local user DB.

So far I mainly used it as RADIUS server (Corp LDAP as back-end) in order to add MFA.

But now following our new requirement I didn't find a way to use it as LDAP server for accounts that are imported from Corp LDAP.

Is it me or this feature is not available?

[pminarik · Accepted solution]

Full-on LDAP proxy feature is not available currently. Your observations are correct. :)

[dingjerry_FTNT]

Hi @AEK ,

I hope this Youtube video can help you:

https://www.youtube.com/watch?v=7KrZjqmcIhc&ab_channel=FullProxyLabs

[AEK]

Hi Jerry

Unfortunately on the video he is configuring FAC's front-end as RADIUS, not LDAP :(

[dingjerry_FTNT]

Sorry, AEK, I did not watch it.

[sw2090]

we do that here by having some task in fac that regularly fetches users from AzureAD if they are in a specific AD group. You need the fetch these in order to be able to apply MFA to the user in FAC :)

FAC then acts as radius server for our FGT and IPSEcs and even some AD things. Works fine with AD Auth as 1FA plus FortiToken as 2FA. 

The only negative thing is that some Fortinet Appliances (like e.g. FAZ) do not support radius user groups which requires me to manually create the users there as radius users.

Fortigates and FOS IPSec xauth do support radius groups though.

[sw2090]

and AD basically is LDAP too :)

[pminarik · Accepted solution]

Full-on LDAP proxy feature is not available currently. Your observations are correct. :)

[ebilcari · Accepted solution]

So basically you need to 'proxy' the LDAP through FAC and apply tokens to the users. I did a quick check internally and this is not currently supported in FAC. You can read more about the FortiAuthProxy that seems to support your request.

[AEK]

Thanks for the confirmation.

I also see FortiAuthProxy is new Fortinet product. First time I hear about. Thanks for the info.