Kerberos, explicit proxy and ad group membership change

[judit]

Hi,

I have configured kerberos authentication against windows AD with explicit proxy yesterday and it works fine. I have moved a user from an AD group to another AD group today, but the fortigate firewall still does not recognize the change of the AD group membership after serveral hours. Is there a timeout or a value for user group lookup on the fortigate firewall? Thanks and kind regards, Judit

[xsilver_FTNT]

Hi Judit,

basic concept is that once user authenticate himself, the timeout is 'idle' one. And so till user leave session idle for certain time he is considered authenticated and his authenticated status prolongs.

Group membership is evaluated at the login time. And most of the login mechanisms do not handle group membership changes. With one exemption of FSSO, but even there it has to be set up explicitly.

AFAIK there is no way to set group membership periodic check for firewall authentications (except mentioned FSSO on standalone Collector or FortiAuthenticator).

Simplest way is to de-authenticate user from FGT manually and so force him to re-authenticate and so get group membership evaluated again. Another way is to change user settings from idle-timeout to hard and de-facto force user to re-authenticate every few minutes/hours.

[judit]

Hi, thank you for your reply. I have configured authentication hard timeout for the user and for the user groups and have set the commando 'set ip-based disable', but the fortigate still doesn't recognize ad-group membership Change within 60 minutes. Is there a configuration detail missing? Thanks and kind regards, Judit

config user setting     set auth-timeout 60     set auth-timeout-type hard-timeout end

config user group     edit "Fortigate-Web-A"         set authtimeout 60         set member "LDAP-Kerberos"         config match             edit 1                 set server-name "LDAP-Kerberos"                 set group-name "CN=Fortigate-Web-A,OU=Fortigate-Security-Groups,DC=XX,DC=local"             next         end     next

 edit "Fortigate-Web-B"         set authtimeout 60         set member "LDAP-Kerberos"         config match             edit 1                 set server-name "LDAP-Kerberos"                 set group-name "CN=Fortigate-Web-B,OU=Fortigate-Security-Groups,DC=XX,DC=local"            next        next end

config authentication rule     edit "proxyauth"         set srcaddr "all"         set ip-based disable         set active-auth-method "kerberos"     next end

[judit]

Hi, Fortinet Support told me today to upgrade to 6.0.x

because  in 5.6 there is no way to set a hard timeout for the proxy with kerberos.

There are new commands introduced in 6.0 that should help you with your issue:

config system global set proxy-auth-lifetime Enable/disable authenticated users lifetime control. This is a cap on the total time a proxy user can be authenticated for after which re-authentication will take place. set proxy-auth-lifetime-timeout Lifetime timeout in minutes for authenticated users (5 - 65535 min, default=480 (8 hours)). set proxy-re-authentication-mode Control if users must re-authenticate after a session is closed, traffic has been idle, or from the point at which the user was first created.

Please see the following document: https://help.fortinet.com...tication%20timeout.htm