Import LDAP Users with FortiToken-Mobile for SSL VPN

[make]

Hello everyone,

i need to build a new customer environment, wheree a SSL-VPN with FortiToken-Mobile as a second factor for authentication need to be implemented.

Unfortunately the new customer has more than 200 Employees, which means it would be a lot of clicking-work to import all the LDAP users and assign a FortiToken-Mobile to the account and send the Activation-Code. And directly adding an AD Group wouldn't help either...

My Question is if there is an easy (lazy) way to import so much Users, assign them FortiToken-Mobile and send the Activation Codes?

We managed another customer with regular FortiTokens where a FortiAuthenticator reads the Token-SN from an extra field from the user attributes, but i couldn't figure out how this would work with mobile tokens.

Looking forward for your reply's

Thank You

[MikePruett]

I would use a FortiAuthenticator and then just allow it to auto issue mobile tokens to users that are imported from the AD groups.

Would be quick and relatively easy management wise.

[xsilver_FTNT]

Mike is right, this is the lazy man way. Feature on FortiAuthenticator (FAC) you are looking for is called 'Remote User Sync Rules'. In Authentication/User Management  GUI section.

Allows you to dynamically sync users from LDAP. So whenever LDAP changes it is reflected on FAC. If rule has token priority set to assign available mobile token, then user will automatically get activation instructions and codes via email/SMS (email address or mobile phone number has to be part of user data and synced to FAC).

When user is removed from LDAP, then FAC will remove user and release the token for future re-use as well.

Pretty neat and useful feature I think.

Best regards,

Tomas

[make]

Hi Guys,

thank you for your answers.

It took some time but I could finally install a FortiAuthenticator for Evaluation.

It is configured with 100 FortiToken Mobile (all Status available), the LDAP Connect to the DC and it successfully synced testusers (with E-Mail addresses) with a User Group on the FortiAuthenticator via the Remote User Sync Rules. The Sync rule includes Token-based authentication sync priorities: FortiToken Mobile (assign an available token)

The remaining problem is that the FortiTokens Mobile are not assigned to the users.

I checked this in Authentication > User Management > FortiTokens. The User field is empty on all tokens.

Also under Authentication > User Management > Remote Users. The Token field is empty by all testusers.

Looking forward for your reply's Thank You very much

[emnoc]

You should be able to  export the AD-user by doing a simple ldap search and get the username@domain.com and script  it to blast the activation codes.

Might take a little leg work to get  the ldap query for the user name and  email and loop thru the available activation codes to send to users.

Are all users in the same AD group ? Can you query that group for the username and email-address ?

just my 2cts

 e.g

ldapsearch -x -h 10.0.1.1 -D "ken.felix@mydomain.com" -W -b "CN=VPN Users,OU=Access groups,OU=Road Warriors,DC=mydomain,DC=com"  | grep member: | cut -d "=" -f2

Once you get the users, just mail blast them the activation code to username@yorudomain.com

Ken

[xsilver_FTNT · Accepted solution]

I would suggest to check the log and look for the reason why token was not assigned.

Possible reasons I see .. - there was no token in available state mean unsuitable for being assigned

- tokens there were somehow imported (for example from config restore) but they belong to license which belongs to (was activated on) different FGT/FAC unit and so this FAC is not allowed/permitted to assign such token to user (FortiGuard will reject such assignment request)

- there is no email address synced from LDAP and therefore there is nowhere to deliver activation codes => assignment is canceled for that reason

- there is no working SMTP server (see https://<FAC-IP|FQDN>/admin/system/smtpserver/ ), so result is the same as in previous step, FAC is unable to deliver the activation code and so assignment could not be completed = result is canceled action and unassigned token. Also check Email Services and which one is used for users. If default, then on previous SMTP Servers check which one is default.

Use one test user and check above conditions.

Then delet that user from FAC Remote Users and let it resync (wait sync timer or force manual resync via menu button).

Then check if token was assigned and if not check for reason in log.

If it is going to work, then you can probably delete all Remote Users synced via that rule and let them resync as with test user.

[make]

Hi Guys,

thank you for your support. I rechecked the whole configuration and it's working fine now.

I'm not 100% sure but I assume there was a problem with the SMTP configuration.

The FortiAuthenticator assigns available FortiTokens Mobile to new synced Users from the LDAP Server, sends the QR-Code to the Users synced mail address and the two-factor-authentication works properly.

Thank you all for your reply

[sotir1984]

Hi guys,

Can someone share how you do the FortiGate -> FortiAuthenticator integration after this initial FortiAuthenticator - Ad integration?

-1984-