Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
AEK
SuperUser
SuperUser

FreeIPA with FSSO

Hello

Has anyone tried integrate FreeIPA with FSSO, like by sending syslog from the LDAP to FSSO agent or FortiAuthenticator, or any other method?

AEK
AEK
4 REPLIES 4
pminarik
Staff
Staff

Syslog can potentially work fully indepedently (taking both username and group from the message), or do membership lookup via relatively configurable LDAP lookups (collector Agent has separate LDAP config for Syslog), so I would expect both to work with Syslog.

Just keep in mind that there will be no dynamic IP change detection or logout detection. This will fully rely on the Syslog source sending these updates too.

 

Another possibility could be translating RADIUS accounting messages into FSSO. Same workflow as with Syslog: Receive > process (optionally LDAP group lookup) > generate FSSO session.

 

Other MS AD-integrated methods are not expected to work at all. (event log scraping, DC Agents, FSSOMA).

[ corrections always welcome ]
AEK

Thanks Minarik

Any document describing the procedure?

AEK
AEK
pminarik

You could try this doc to get an idea of how to configure it: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configure-Fortinet-Single-Sign-On-FSSO-for...

 

The core is getting a sample of the Syslog messages and setting up the parsing rules for them. Then you need to decide if you can use the message itself for learning user groups, or whether to use LDAP for group lookups (in which case you will need to configure the LDAP portion, which is done similarly as with FortiGate/FAC being configured as LDAP clients - need to know how your LDAP tracks group membership, and then set the filters/objectClasses for it in the config).

 

There is a test-field in Collector/FAC so you can paste in the Syslog message and directly test if the filters match and extract the values correctly.

[ corrections always welcome ]
AEK

Thanks again Minarik, I appreciate your help.

AEK
AEK
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors