LDAP Query

[Piotras]

I have configured authentication for FSSO and i want create the report in FortiAnalyzer where user belongs to a particular group or organizational unit. Theoretically, i may use an LDAP Query, however, it is nowhere described as the benefit from this. Does anyone know how this works? FortiGate 5.2 FortiAnalyzer 5.2 FSSO 4.3.0156 - AD access mode: standard Regards

[hzhao_FTNT · Accepted solution]

LDAP works OK on FAZ5.2.1 and 5.0.10. 

hz

[hzhao_FTNT]

1. Add and configue a LDAP server in GUI, please refer to: http://docs.fortinet.com/d/fortianalyzer-5.2.0-administration-guide Page 83 2. More advanced setting for ldap server in CLI if needed, please refer to: http://docs.fortinet.com/d/fortianalyzer-5.2.0-cli-reference Page 34 3. Enable LDAP query and apply group filter in report setting: http://docs.fortinet.com/d/fortianalyzer-5.2.0-administration-guide Page 170 4. Run report Regards, hz

[Piotras]

That' s what I did, but it didn' t work. I run a sniffer on the FAZ, and when I run the report I don' t see any traffic to Active Directory. config system admin ldap edit " Test" set server " 10.48.7.100" set cnid " cn" set dn " DC=domena,DC=wew" set type regular set username " CN=sc_FG,OU=Fortigate,OU=Systemy,DC=domena,DC=wew" set password ENC * set adom " all_adoms" next end

[hzhao_FTNT]

Hi Piotras, 1. Please check if you can query distinguished name in GUI. 2. Please check ldap server config again under CLI: conf sys admin ldap edit test get If filter and attributes are none, please set a proper value according to your ldap server config, for example: set filter (|(objectclass=person)(objectclass=user)) set attributes member,uniquemember end 3. Please disable case change, this feature is not functional because of a bug. Regards, hz

[Piotras]

Ad. 1 I can query distinguished name from GUI. Ad. 2 This is configuration LDAP from CLI: (Test)# get name : Test server : 10.48.7.100 cnid : cn dn : DC=domain,DC=local port : 389 type : regular username : * password : * group : (null) filter : (|(objectclass=person)(objectclass=user)) attributes : member,uniquemember secure : disable connect-timeout : 500 adom: == [ all_adoms ] adom-name: all_adoms Ad. 3 I disabled case change, but nothing has changed. Certainly in version 5.2, this functionality works correctly?

[hzhao_FTNT]

Hi Piotras, The basic LDAP feature should be working OK in 5.2.0 B618. Could you request a customer ticket and post your ticket number here? We may need look into your case closer. Regards, hz

[xinger]

Did this get resolved?  Can someone post a solution?  Thanks!

[hzhao_FTNT · Accepted solution]

LDAP works OK on FAZ5.2.1 and 5.0.10. 

hz

[xinger]

hzhao_FTNT wrote:

LDAP works OK on FAZ5.2.1 and 5.0.10. 

Yes, it works on FAZ 5.2.1!  Thanks!  However, the feature still needs to be documented better (IMHO) and it still has a bug. 

The bug: A packet sniff showed me that the LDAP group query truncated my group name at the first blank.  When my report filter included "Group equal to ABC-XY-Information Technology", my report was empty and the LDAP packet showed only "ABC-XY-Information";  "Technology" had been truncated.  However, it worked when I renamed the group in my directory replacing the blank with a hyphen, and then filtering on "Group equal to ABC-XY-Information-Technology". 

The documentation: I had to use Change Case = Upper because user names are upper case in my Fortinet logs.  And here is what worked in my LDAP configuration (Windows Active Directory environment).

cnid                : cn dn                  : the distinguished name of either the root (dc=xyz,dc=com)

                      or the OU where the reporting groups are (ou=mygroups,dc=xyz,dc=com)

group               : (null) worked for me; I didn't experiment with values. filter              : I couldn't unset filter, but both of the following worked for me.

                      (|(objectclass=person)(objectclass=user))

                      (&(objectcategory=group)(member=*))

                      And seeing the these filter completely different objects,

                      I must conclude that this filter setting isn't used for report queries.

attributes          : member worked for me. I was unable to unset it.

                      I had mixed results when I tried setting it to other values.

[hzhao_FTNT]

Hi Xinger,

Thanks for your detailed testing. For "Group equal to ABC-XY-Information Technology", could you try:

Group equal to "ABC-XY-Information Technology"

By design, when there is a space, we have to use double quotation in filter.

Regards,

hz