I have a fortigate 100E. I recently replaced an Domain Controller (it crashed) that the fortigate was connected to through LDAP. I have updated the LDAP settings to the new Domain Controller. It passes the "test connectivity" test.
However going to "Users and Authenication"->"Ldap Servers"-> select LDAP server-> click "Test Users Credentials"; the some users cannot get the credentials validated. it is weird, I can't figure out why some people (like myself) can get "User Credentials Successful" and some users get "User Credentials Invalid Credentials"
fnbamd is the authentication daemon that will show any LDAP and RADIUS authentication that FortiGate creates and the results of it. Failed authentications will show there.
You might only want to add a timestamp to the log:
diag debug console timestamp enable
diag debug app fnbamd -1
diag debug enable
How they exactly looks like depend on the setup. There will be a binding with the bindDN you are using and another bind with the user you try to authenticate. After that you typically should see a memberof query. That again depends on the setup.
I may have solved the problem but want your opinion. on our Active Directory, we set the "Log on To" which restricts which computers the user can log on to. when I removed it (ie no restriction). the user was able to connect the LDAP. and then VPN started working again. Anyone have an opinion on this? would this be the issue? is there a work around so I can restrict computers?
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.