Fortigate change username mapping from AD

[Yesolo]

When create users from LDAP server (in my case, Microsoft AD server), the ID (username on Fortigate) of created user is actually "display name" of this user in AD. The request is to change the username on Fortigate from this display name to "sAMAccountName" or "userPrincipalName". Is it possible? And how?

[Yesolo]

Snapshot:

[Durga_Ashwath]

Hi Team,

Pleased o follow the below document:
> https://docs.fortinet.com/document/fortigate/6.4.2/administration-guide/795593/use-active-directory-...

Regards,
Durga A

[Yesolo]

Hi, thanks for the reply, but we don't have a FSSO Collector Agent now, we will try this later if other solutions don't work.

[bpozdena_FTNT · Accepted solution]

Yes, it's possible to change. By default LDAP users will be imported based on their 'CN' attribute, which is usually the same as 'DisplayName'.

You will need to change the CNID value under your LDAP profile to change the behavior.

For instance, if you want your users to be imported with usernames based on the 'userPrincipalName' attribute, use the bellow configuration:

config user ldap
    edit "YOUR-LDAP-PROFILE-NAME"
        set cnid "userPrincipalName"
    next
end

If you want the imported usernames be based on the 'sAMAccountName', simply change the settings as bellow:

config user ldap
    edit "YOUR-LDAP-PROFILE-NAME"
        set cnid "sAMAccountName"
    next
end

Just note that after you change the value, you will need to delete and re-import all users again.

[Yesolo]

Hi, it works, thank you very much!