Hi,
I have configured kerberos authentication against windows AD with explicit proxy yesterday and it works fine. I have moved a user from an AD group to another AD group today, but the fortigate firewall still does not recognize the change of the AD group membership after serveral hours. Is there a timeout or a value for user group lookup on the fortigate firewall? Thanks and kind regards, Judit
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hi Judit,
basic concept is that once user authenticate himself, the timeout is 'idle' one. And so till user leave session idle for certain time he is considered authenticated and his authenticated status prolongs.
Group membership is evaluated at the login time. And most of the login mechanisms do not handle group membership changes. With one exemption of FSSO, but even there it has to be set up explicitly.
AFAIK there is no way to set group membership periodic check for firewall authentications (except mentioned FSSO on standalone Collector or FortiAuthenticator).
Simplest way is to de-authenticate user from FGT manually and so force him to re-authenticate and so get group membership evaluated again. Another way is to change user settings from idle-timeout to hard and de-facto force user to re-authenticate every few minutes/hours.
Tomas Stribrny - NASDAQ:FTNT - Fortinet Inc. - TAC Staff Engineer
AAA, MFA, VoIP and other Fortinet stuff
Hi, thank you for your reply. I have configured authentication hard timeout for the user and for the user groups and have set the commando 'set ip-based disable', but the fortigate still doesn't recognize ad-group membership Change within 60 minutes. Is there a configuration detail missing? Thanks and kind regards, Judit
config user setting set auth-timeout 60 set auth-timeout-type hard-timeout end
config user group edit "Fortigate-Web-A" set authtimeout 60 set member "LDAP-Kerberos" config match edit 1 set server-name "LDAP-Kerberos" set group-name "CN=Fortigate-Web-A,OU=Fortigate-Security-Groups,DC=XX,DC=local" next end next
edit "Fortigate-Web-B" set authtimeout 60 set member "LDAP-Kerberos" config match edit 1 set server-name "LDAP-Kerberos" set group-name "CN=Fortigate-Web-B,OU=Fortigate-Security-Groups,DC=XX,DC=local" next next end
config authentication rule edit "proxyauth" set srcaddr "all" set ip-based disable set active-auth-method "kerberos" next end
Hi, Fortinet Support told me today to upgrade to 6.0.x
because in 5.6 there is no way to set a hard timeout for the proxy with kerberos.
There are new commands introduced in 6.0 that should help you with your issue:
config system global set proxy-auth-lifetime Enable/disable authenticated users lifetime control. This is a cap on the total time a proxy user can be authenticated for after which re-authentication will take place. set proxy-auth-lifetime-timeout Lifetime timeout in minutes for authenticated users (5 - 65535 min, default=480 (8 hours)). set proxy-re-authentication-mode Control if users must re-authenticate after a session is closed, traffic has been idle, or from the point at which the user was first created.
Please see the following document: https://help.fortinet.com...tication%20timeout.htm
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1677 | |
1085 | |
752 | |
446 | |
226 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.