LDAP Group Membership update - Mac OS X

[ed_b]

Hello there,

Currently testing a Fortigate unit for possible use in production soon.

We have a scenario where we need to set URL filtering based on LDAP group membership but the group membership changes frequently. A user could be in and out of a group multiple times in a day, for example.

We're using a collector agent with DC polling for collecting user details at the moment, which seems to be working well enough (300 users), and it seems group membership gets updated fairly frequently with Windows users (I'm guessing with the ~5 min workstation checking interval), but Mac OSX users' group memberships don't get updated until a logoff or screen lock/unlock.

My question is, is it possible for the Fortigate to update group membership for Mac Users without them having to logoff and back on again? Any other approaches I should be looking at?

Help/advice greatly appreciated

Cheers.

[Christopher_McMullan]

The problem is finding a logon event to track, or else having access to the registry on client machines to determine who is (still) logged in. Ports TCP/139 and TCP/445, when opened, will allow the Collector Agent (FSSO) to contact the Remote Registry service (a Windows service; you can see it under services.msc). However, the service needs to be started, and many times the ports are closed by a software firewall or intervening network hardware.

In the case of Windows hosts, the Workstation Verify Interval default of 5 minutes means this check is performed regularly. Any dead entries are allowed to persist (again, by default) for 8 hours before being scrubbed. Users who logout at night and log back in in the morning would never notice the mis-configuration. But those who only lock their screens, for example, would have network access on Monday and get locked out Tuesday morning. Finally, any IP changes (maybe a user connecting via lobby WiFi who docks their laptop when they get upstairs?) are validated every 60 seconds (the IP Address Change Verify interval).

For Mac users, the traditional way to create a logon event was to mount a network share. The authentication would be picked up by the FSSO Collector Agent. If your group memberships change constantly, you would need to look at another paradigm to track the "after initial login" changes to the user's privileges and permissions.

[ed_b]

Thanks for your reply. Am I correct in saying that the only way for the Fortigate to receive updated LDAP group membership is by triggering a logon event from the Mac? (whether that's by mapping a drive, logging on or some other method.)

Cheers

[Christopher_McMullan · Accepted solution]

Just off the cuff, you'd likely have to enable Advanced Mode within the Collector Agent to harness the LDAP server's user account information. From there, there is a timed cache on user group memberships which should probably be lowered for more frequent checking against the LDAP server.

Haven't tested the scenario or had to perform troubleshooting on it in real life yet, but if you have the scope to play around and test it, that is the route I would go.

[ed_b]

Hi Chris, 

Thanks for pointing me in the right direction - I found the "Group lookup interval" setting in the Advanced Settings of the Collector agent which was set to zero by default (no checking). Setting this to a lowish value seems to do the trick and group memberships for all users are updated regularly on the Fortigate

Cheers