Fortigate LDAP Authentication To FreeIPA with Group Filtering

[lradmin]

Is there a way to restrict LDAP authentication to FreeIPA based on ldap user group membership? Currently configured, as suggested in forum, with

set cnid uid
set dn "cn=accounts,dc=<suffix>,dc=<suffix>

However this setup allows ANY ldap user to be successfully authenticated. I can't figure out a way to restrict it to only a specific ldap group in FreeIPA. Suspecting it has to do with one of setting either of the config option group-member-check, group-search-base and group-filter.

Any help will be greatly appreciated!

[JackTrades]

Hi,

after defining the server you have to import users and groups for the usage in policies.

Technical Tip: How to configure LDAP server - Fortinet Community

This should fulfill your use cases, because only users/groups listed in your policy can access ressources.

[kpante]

Hi, I got this to work with the following configuration (User attribute checking):

config user ldap
  edit "ipa"
    set server <SERVER>
    set cnid "uid"
    set dn "cn=accounts,dc=example,dc=com"
    set type regular
    set username "uid=<BIND-USER>,cn=users,cn=accounts,dc=example,dc=com"
    set password <PASSWORD>
    set group-search-base "cn=groups,cn=accounts,dc=example,dc=com"
    set group-filter "(&(objectClass=groupofnames)(member=%u))"
    set secure ldaps
    set port 636
  next
end

config user group
  edit "remote_administrators"
    set member "ipa"
    config match
      edit 1
        set server-name "ipa"
        set group-name "cn=<GROUP>,cn=groups,cn=accounts,dc=ipa,dc=pante,dc=be"
      next
    end
  next
end

You have to specify 'cn=accounts' in the Base DN otherwise 'cn=compat' will be used.

Keep in mind that when you use LDAPS the certificate has to be trusted.