Fortigate 100E and LDAP security groups issue

[Tindrli]

Hi,

I have Fortigate 100E with FortiOS 5.6.4 and I'm having a problem with using security groups in LDAP. I configured LDAP on my FGT and test went OK. If i create a policy with a single user than that policy works, but if I add that user to a group and then create a policy with a group then it's no go. I've found online quite a few questions about this problem but no answer.

Can someone give me an idea what to look for or how to make this work?

[xsilver_FTNT]

Hi,

made it working in lab test with no issues on 'Version: FortiGate-VM64 v5.6.4,build1575,180425 (GA)' ...

config user local

edit "usera" set type ldap set ldap-server "C24_ALFA.XSILVER.ORG" next edit "userb" set type ldap set ldap-server "C24_ALFA.XSILVER.ORG" next end

config user ldap edit "C24_ALFA.XSILVER.ORG" set server "10.109.19.88" set cnid "cn" set dn "dc=alfa,dc=xsilver,dc=org" set type regular set username "cn=administrator,cn=users,dc=alfa,dc=xsilver,dc=org" set password ENC  <cut>

next end

config user group

edit "LOC-LDAP-Users" set member "usera" "userb" next end

config firewall policy edit 2 set uuid affd8bd8-89c5-51e8-3761-c8443d143c74 set srcintf "port2"  <this is where test WKS Win7 sits set dstintf "port1"  <WAN port set srcaddr "all" set dstaddr "all" set action accept set schedule "always" set service "ALL" set logtraffic disable set fsso disable set groups "LOC-LDAP-Users" set nat enable next end

# debug - showed that LDAP auth was successful

diag debug fnbamd 7

diag debug enable

c2fgvm # [2135] handle_req-Rcvd auth req 1065032223 for usera in opt=00000500 prot=10 [605] fnbamd_pop3_start-usera [340] radius_start-Didn't find radius servers (0) [706] auth_tac_plus_start-Didn't find tac_plus servers (0) [1145] __fnbamd_cfg_get_ldap_list_by_group-Loading LDAP server 'C24_ALFA.XSILVER.ORG' for usergroup 'LOC-LDAP-Users' (4) [871] resolve_ldap_FQDN-Resolved address 10.109.19.88, result 10.109.19.88 [1147] build_search_base-search base is: dc=alfa,dc=xsilver,dc=org

[1267] fnbamd_ldap_init-search filter is: cn=usera

[492] create_auth_session-Total 1 server(s) to try [263] start_search_dn-base:'dc=alfa,dc=xsilver,dc=org' filter:cn=usera

[1652] fnbamd_ldap_get_result-Going to SEARCH state [2843] auth_ldap_result-Continue pending for req 1065032223 [1550] fnbamd_ldap_get_result-Not ready yet [2843] auth_ldap_result-Continue pending for req 1065032223 [296] get_all_dn-Found DN 1:CN=usera,CN=Users,DC=alfa,DC=xsilver,DC=org

[310] get_all_dn-Found 1 DN's [344] start_next_dn_bind-Trying DN 1:CN=usera,CN=Users,DC=alfa,DC=xsilver,DC=org [1700] fnbamd_ldap_get_result-Going to USERBIND state [2843] auth_ldap_result-Continue pending for req 1065032223 [570] start_user_attrs_lookup-Adding attr 'memberOf' [591] start_user_attrs_lookup-base:'CN=usera,CN=Users,DC=alfa,DC=xsilver,DC=org' filter:cn=*

[1756] fnbamd_ldap_get_result-Entering CHKUSERATTRS state [2843] auth_ldap_result-Continue pending for req 1065032223 [793] get_member_of_groups-Get the memberOf groups. [828] get_member_of_groups- attr='memberOf', found 2 values [837] get_member_of_groups-val[0]='CN=UG_SSO_Users,CN=Users,DC=alfa,DC=xsilver,DC=org' [837] get_member_of_groups-val[1]='CN=RUSR_Users,CN=Users,DC=alfa,DC=xsilver,DC=org' [626] start_primary_group_lookup-starting check... [630] start_primary_group_lookup-number of sub auths 5 [648] start_primary_group_lookup-base:'dc=alfa,dc=xsilver,dc=org' filter:(&(objectclass=group)(objectSid=\01\05\00\00\00 \00\00\05\15\00\00\00\bb\f4\90\f4\30\bd\1f\79\0b\35\92\63\01\02\00\00))

[1780] fnbamd_ldap_get_result-Entering CHKPRIMARYGRP state [2843] auth_ldap_result-Continue pending for req 1065032223 [776] get_primary_groups-primary group: CN=Domain Users,CN=Users,DC=alfa,DC=xsilver,DC=org [1814] fnbamd_ldap_get_result-Auth accepted [1925] fnbamd_ldap_get_result-Going to DONE state res=0 [2748] fnbamd_auth_poll_ldap-Result for ldap svr 10.109.19.88 is SUCCESS [2768] fnbamd_auth_poll_ldap-Skipping group matching [899] find_matched_usr_grps-Skipped group matching [182] fnbamd_comm_send_result-Sending result 0 (error 0, nid 0) for req 1065032223 [638] destroy_auth_session-delete session 1065032223

[Tindrli]

Hey,

I forgot to update this thread with new information. I made it work after a while. Problem was with SSO configuration on the box  itself. When i tried to set it up initially I used to choose advanced mode and that's where the problem was. When i changed that portion of the setup to standard, i was able to see all the users and groups. Now i can setup my policies based on security groups on AD. Glad to see that someone actually tried to replicate this issue and found a minute to reply. 

[xsilver_FTNT]

Hi,

from your initial post I thought you are trying to set up LDAP users, not FSSO, which is completely different auth method.

BTW: Standard vs Advanced FSSO is almost only about format of the user groups in filter.

Standard uses MSFT fromat while Advanced uses LDAP format for group written.

So if you do set LDAP into FSSO Agent on FGT, then format of chosen groups is obviously LDAP one, and if Collector run in Standard mode and process groups in MSFT format, then those from FGT and Collector can not match!

But you can set Collector to Advanced, set Group Filter on Collector and also use LDAP format and groups pushed to FGT. With no problem.

Just to clarify and help someone who will accidentally read that.