Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
emike09
New Contributor

Invalid Password when authenticating admin via LDAP

Hey all,

Just getting our Fortigate 601e set up (FoS 7.0.1), first time working with Fortinet. When attempting to log in via my own domain account, I get a message saying Authentication Failed, and when viewing the logs, I see the following:

3 Minutes ago: Administrator (user.name) login failed from https(10.x.x.x) because of invalid password.

 

I'm really not sure what I'm doing wrong here, and I'm positive that the password is correct. I tried resetting it on our AD server as well. I've read multiple guides for LDAP setup, as well as watched a few YouTube videos, and the results are the same. What's even weirder, is that the logs show a couple successful logins for my domain account, however, I was still presented with Authentication Failed when the logs show that I logged in, when in fact, I did not.

 

35 Minutes ago: Administrator user.name logged in successfully from https(10.x.x.x)

 

Under LDAP Servers, I have one of our DCs configured. Using the IP address, sAMAccountName, Regular bind type using cn=, ou=, etc. When testing connectivity or user credentials, both test as Successful. 

 

I've configured a Remote User Group called FortiAdmin, Type: Firewall, and added the Domain Admins group. 

 

I created an Admin Profile called FortiAdmin with all permissions. Lastly, I created an Administrator called FortiAdmin: Match all users in a remote server group, with FortiAdmin for both the Administrator profile and Remote User Group. 

 

 I feel like I'm missing a step here. Any thoughts are appreciated! 

 

2 REPLIES 2
xsilver_FTNT
Staff
Staff

So it's LDAP Wildcard admin. Check your setup against those steps .. GUI of 7.x might be different however CLI is supposed to be same AFAIK. https://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=FD32608

 

Hints: - I would test this with one of the default accprofile options like prof_admin or so.

- make sure that the admins group is not used anywhere else besides that 'config system admin' setting

- make sure that the remote admin has 'set wildcard enable'

Tomas Stribrny - NASDAQ:FTNT - Fortinet Inc. - TAC Staff Engineer
AAA, MFA, VoIP and other Fortinet stuff

emike09

Just to follow up on this - After much troubleshooting with Fortigate engineers, it turns out it was something on our domain. A legacy attribute called msNPAllowDialin. Fortigate can work with this, it just needs to be configured via CLI. Make sure to change anything inside of [ ] to reflect your own environment. 

 

config user ldap
     edit "[domain controller]"
         set server "[IP or DNS Address]"
         set cnid "sAMAccountName"
         set dn "[DC=domain,DC=org]"
         set type regular
         set username "CN=[user],OU=[group],DC=[domain],DC=[org]"
         set member-attr "msNPAllowDialin"
         set group-member-check group-object
     next
 end

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors