Fortiauthenticator ldap auth both dnshostname and samaccountname

[thilinapm]

Hi,

Is it possible to use both SamAccountName and DnsHostname authenticated against same LDAP server. I cannot get it worked. If I changed the username attribute to dnshostname as below it authenticates with dnshostname but not with samaccountname, how can I get both working so I can authenticate using both computer name and username ?

Thanks

Thilina

[Markus_M]

Hi,

No. You cannot do this in one LDAP entry. The entry will ask for the supplied username to be found in the Username Attribute. This is intended as you do not mix computer and username attributes and then put them into a group.

A computer can be used by multiple users.

A user can use multiple computers.

To accommodate appropriate settings for the objects, you will need to create two LDAP server entries.

Best regards,

Markus

[thilinapm]

Thanks Markus ,

But what if I need to do peap for wired users using computer name authentication and Wireless authentication using User authentication on BYOD devices ? , I cannot get it work because of this limitation.

And I cant create 02 ldap server entries to the same server, it doesnt allow that.

Thanks

Thilina

[thilinapm]

And Windows NPS allows to do this easily, cant understand why FAC cant do that.

[Markus_M · Accepted solution]

Hi Thilina,

you need to create 2 LDAP server entries. Not two entries within one LDAP server.

You can define the "realm" that your users are in, if need be.

You will likely already have two RADIUS policies that refer to your user bases.

- wired users, so a switch as a RADIUS client.

- wireless users - a WLC as a RADIUS client.

Best regards,

Markus

[thilinapm]

Thanks Markus,

I believe you meant another LDAP entry to another DC in same domain, right?

Regards

Thilina

[Markus_M]

Hello Thilina,

Another LDAP entry, but it can be the same domain (try it out!).

The mapping is the important part. One LDAP entry can be used for one LDAP attribute, as samaccountname, the other LDAP entry can map another LDAP attribute as dnshostname.

Best regards,

Markus

[thilinapm]

Thanks Markus,

Will try it out and let you know.

Regards

Thilina

[thilinapm]

Hi Marcus,

That did the trick. FAC accepted it and all good and working now as expected.

Thanks ....

Regards

Thilina

[jbackstrom]

We have run this setup for a while where we have 3 LDAP server entries for samaccountname, UPN and dnshostname pointing to the same AD with different DNS names and IP adresses. However we have had issues where basically only one have been active at once causing issues. Our solution was changing "FortiAuthenticator NetBIOS name" to unique names for every entry along with separate service accounts for each entry. Adding this here to maybe spare some time for someone else.

Regards,

Joakim