LDAP Authentication for Extensions in FortiVoice

[Andrew_ROW]

Hi All

Relatively new to FortiVoice and trying to learn how to use some of it's handy features to make life easier. This May be a noob question but I am stumped so I am asking it.

I have the LDAP profile setup on my FVE 2000VM 6.4.4.  Works fine for setting up LDAP authenticated admins. I am a bit lost on how I can use LDAP for extension logins on the user portal

My goal at the moment to create a number with access to the user portal that I can have my On-Call team login to and change the call forward. So instead of using the ext as the login, I figured LDAP would be better.

According to this article http://docs.fortinet.com/document/fortivoice-enterprise/6.4.4/fortivoice-cookbook/344148/applying-th...

I am to use Search User and Try Bind DN, then leave the Authentication ID field empty for my settings.  What I don't know is how I associate the user to the extension. I am guessing this is what the extension LDAP connector is for?

In which case does the connector only pull data or does it push data to AD as well?

If anyone has any thoughts, I'd appreciate it. 

[Anonymous]

Hello Andrew_ROW, 

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible. 

Thanks, 

  Fortinet Community Team 

[melshehaby]

Hello @Andrew_ROW 

Thank you for reaching us here.

Generally speaking the LDAP connectors are sending a queries with attributes to LDAP server "AD" and getting the response from them to proceed with the actions.

Regarding the LDAP authentication for extensions User Portal, you have two options:

Option 1:

If you configured the LDAP profile with "Try Common Name with Base DN as Bind DN"  this means that you will manually map each extension to specific username.

So please follow the below:

1. Phone System > LDAP > LDAP Profile > edit the LDAP profile
2. Under User Authentication Options, select "Try Common Name with Base DN as Bind DN"
3. Then configure "Common name ID" with value "cn" to map the username or the attribute that you want to map it from you LDAP server.
4. Then Go to Extension > Extension > IP Extension > edit the extension
5. Under User Setting, in the Web Access tab, with Authentication type to LDAP with the configured LDAP profile.
6. Configure "Authentication ID:" with the username "cn value" for the user that you want to map or authenticate this extension with his account.
7. Once you are done, you can open the User Portal and in "Username filed" type the extension number and in "Password" type the password's of configured username in this extension.

Option 2:

If you configured the LDAP profile with "Search User and Try Bind DN"  this means that your LDAP server is already configured with extension numbers for each user, and there is an attribute includes the extension number so you will not need to configure each extension with Authentication ID.

So please follow the below:

1. Phone System > LDAP > LDAP Profile > edit the LDAP profile
2. Under User Authentication Options, select "Search User and Try Bind DN"
3. In LDAP user query, the default scheme query for AD is: (&(objectClass=user)(telephonenumber=$u))
   Which is means that in your AD the attribute "telephonenumber" in each user has the extension number.
4. Leave the rest of the options the default.
5. Then Go to Extension > Extension > IP Extension > edit the extension
6. Under User Setting, in the Web Access tab, with Authentication type to LDAP with the configured LDAP profile.
7. Leave "Authentication ID:" empty
8. Once you are done, you can open the User Portal and in "Username filed" type the extension number and in "Password" type the LDAP user password that this extension belongs.

Please feel free to reach us again in case you need more clarification.

Best Regards

EMEA ETAC

Mohamed Elshehaby