LDAP access with sAMAccountName

[FortiRack_Eric]

Hello all, Has anyone any luck and/or succeeded in using the sAMAccountName to login? I' ve succeeded using the UPN’ (Universal Principal Name) OR ‘Display Name’ but the client wants to login using sAMAccountName. Thanks, Cheers, Eric

[#2]

fnbamd_fsm.c[934] handle_req-Rcvd 7 req fnbamd_acct.c[274] fnbamd_acct_start_STOP-Invalid params fnbamd_fsm.c[443] create_acct_session-Error start acct type 7 fnbamd_fsm.c[939] handle_req-Error creating acct session 7

never seen that but my interpretation would be, it never comes to a connection to the ldap server because of an error before. maybe wrong group/user setup on the FGT? so the posted config would never come into play, althoug looks like correct... regards

[#3]

I' m working with LDAP as well. I am trying to check against group membership. Here is what I have for my LDAP Setup: edit " testldap" set server " 10.0.0.5" set cnid ' ' set dn " DC=dom,DC=edu" set type regular set username " CN=administrator,OU=users,DC=dom,DC=edu" set password XXXXXXXX set group " CN=ITStaff,OU=Administration,DC=dom,DC=edu" set filter ' ' and here is what the debug is giving me: MainCampus # fnbamd_fsm.c[460] handle_req-Rcvd auth req 1191 for tgrzeczk@dom.ed u in IPSec VPN LDAP opt=0 prot=5 fnbamd_auth.c[167] radius_start-Didn' t find radius servers (0) fnbamd_ldap.c[332] resolve_ldap_FQDN-Resolved address 10.0.0.5, result 10.0.0.5 fnbamd_ldap.c[667] fnbamd_ldap_get_result-Auth denied fnbamd_ldap.c[675] fnbamd_ldap_get_result-Going to DONE state res=1 fnbamd_auth.c[622] fnbamd_auth_poll-Result for ldap svr 10.0.0.5 is denied fnbamd_comm.c[137] fnbamd_comm_send_result-Sent result 1 for req 1191 Any help would be great.

[ericlam]

I' m working with LDAP as well. I am trying to check against group membership. Here is what I have for my LDAP Setup: edit " testldap" set server " 10.0.0.5" set cnid ' ' set dn " DC=dom,DC=edu" set type regular set username " CN=administrator,OU=users,DC=dom,DC=edu" set password XXXXXXXX set group " CN=ITStaff,OU=Administration,DC=dom,DC=edu" set filter ' ' and here is what the debug is giving me: MainCampus # fnbamd_fsm.c[460] handle_req-Rcvd auth req 1191 for tgrzeczk@dom.ed u in IPSec VPN LDAP opt=0 prot=5 fnbamd_auth.c[167] radius_start-Didn' t find radius servers (0) fnbamd_ldap.c[332] resolve_ldap_FQDN-Resolved address 10.0.0.5, result 10.0.0.5 fnbamd_ldap.c[667] fnbamd_ldap_get_result-Auth denied fnbamd_ldap.c[675] fnbamd_ldap_get_result-Going to DONE state res=1 fnbamd_auth.c[622] fnbamd_auth_poll-Result for ldap svr 10.0.0.5 is denied fnbamd_comm.c[137] fnbamd_comm_send_result-Sent result 1 for req 1191 Any help would be great.

If you' re using the default administrator user account to do the ldap query, it' s located in a Container, not an OU So your set username line should be: set username " CN=administrator,CN=users,DC=dom,DC=edu"

[#5]

your cnid attribute is empty, so you have no attribute to chack against. you really should define a filter. with the provided username and password, can you bind to the ldap server with ldapsearch or a ldap browser tool? regards

[CfSi_Dan]

I was able to resolve my issue with some help from the Fortinet TAC. I was recieving the error:

fnbamd_fsm.c[934] handle_req-Rcvd 7 req fnbamd_acct.c[274] fnbamd_acct_start_STOP-Invalid params fnbamd_fsm.c[443] create_acct_session-Error start acct type 7 fnbamd_fsm.c[939] handle_req-Error creating acct session 7

This was being caused by firewall policy not having the correct user authentication method selected. The default is local, which is what I had my rule set at. I switched the selection to LDAP and everything worked. To troubleshoot whether or not credentials are being passed from the FGT to your LDAP server user the following command.

diag test authserver ldap <server_name> <username> <password>

Also, there is a good KC article on how to secure your LDAP traffic using IPSec from the FGT to your LDAP server. Fortigate KC Article Here' s another good article on how to secure Windows AD using certificates. This can be used for LDAPS on the FGT. Securing LDAP on Windows AD Finally a link to an excellent LDAP Browser Softerra LDAP Browser 2.6