Invalid Password when authenticating admin via LDAP

[emike09]

Hey all,

Just getting our Fortigate 601e set up (FoS 7.0.1), first time working with Fortinet. When attempting to log in via my own domain account, I get a message saying Authentication Failed, and when viewing the logs, I see the following:

3 Minutes ago: Administrator (user.name) login failed from https(10.x.x.x) because of invalid password.

I'm really not sure what I'm doing wrong here, and I'm positive that the password is correct. I tried resetting it on our AD server as well. I've read multiple guides for LDAP setup, as well as watched a few YouTube videos, and the results are the same. What's even weirder, is that the logs show a couple successful logins for my domain account, however, I was still presented with Authentication Failed when the logs show that I logged in, when in fact, I did not.

35 Minutes ago: Administrator user.name logged in successfully from https(10.x.x.x)

Under LDAP Servers, I have one of our DCs configured. Using the IP address, sAMAccountName, Regular bind type using cn=, ou=, etc. When testing connectivity or user credentials, both test as Successful. 

I've configured a Remote User Group called FortiAdmin, Type: Firewall, and added the Domain Admins group. 

I created an Admin Profile called FortiAdmin with all permissions. Lastly, I created an Administrator called FortiAdmin: Match all users in a remote server group, with FortiAdmin for both the Administrator profile and Remote User Group. 

 I feel like I'm missing a step here. Any thoughts are appreciated! 

[xsilver_FTNT]

So it's LDAP Wildcard admin. Check your setup against those steps .. GUI of 7.x might be different however CLI is supposed to be same AFAIK. https://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=FD32608

Hints: - I would test this with one of the default accprofile options like prof_admin or so.

- make sure that the admins group is not used anywhere else besides that 'config system admin' setting

- make sure that the remote admin has 'set wildcard enable'

[emike09]

Just to follow up on this - After much troubleshooting with Fortigate engineers, it turns out it was something on our domain. A legacy attribute called msNPAllowDialin. Fortigate can work with this, it just needs to be configured via CLI. Make sure to change anything inside of [ ] to reflect your own environment. 

config user ldap
     edit "[domain controller]"
         set server "[IP or DNS Address]"
         set cnid "sAMAccountName"
         set dn "[DC=domain,DC=org]"
         set type regular
         set username "CN=[user],OU=[group],DC=[domain],DC=[org]"
         set member-attr "msNPAllowDialin"
         set group-member-check group-object
     next
 end