LDAP Authentication against Windows AD allow both sAMAccountName and userPrincipalName

[lubyou]

Hi,

Is it possible to modify LDAP authentication in way that would allow users to authenticate with either their sAMAccountName or their userPrincipalName?

Thank you

[Jeff_FTNT · Accepted solution]

One LDAP server setting on FGT only use one "cnid".

You may try to set up two LDAP server with different "cnid" on FGT and add those two LDAP server into one "User Group". Both should be works.

####

config user ldap     edit "xxx"         set server "x.x.x.x"         set cnid "userPrincipalName" end config user ldap     edit "yyy"         set server "y.y.y.y"         set cnid "sAMAccountName" end config user group

edit zzz

set member xxx yyy

end

[lubyou]

Jeff_FTNT wrote:

One LDAP server setting on FGT only use one "cnid".

You may try to set up two LDAP server with different "cnid" on FGT and add those two LDAP server into one "User Group". Both should be works.

####

config user ldap    edit "xxx"        set server "x.x.x.x"        set cnid "userPrincipalName" end config user ldap    edit "yyy"        set server "y.y.y.y"        set cnid "sAMAccountName" end config user group

edit zzz

set member xxx yyy

end

A bit of a workaround, but should work. Still a bit unfortunate that one cannot just write a custom filter.

Thank you!