Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
FortiRack_Eric
New Contributor III

LDAP access with sAMAccountName

Hello all, Has anyone any luck and/or succeeded in using the sAMAccountName to login? I' ve succeeded using the UPN’ (Universal Principal Name) OR ‘Display Name’ but the client wants to login using sAMAccountName. Thanks, Cheers, Eric

Rackmount your Fortinet --> http://www.rackmount.it/fortirack

 

Rackmount your Fortinet --> http://www.rackmount.it/fortirack
14 REPLIES 14
Not applicable

fnbamd_fsm.c[934] handle_req-Rcvd 7 req fnbamd_acct.c[274] fnbamd_acct_start_STOP-Invalid params fnbamd_fsm.c[443] create_acct_session-Error start acct type 7 fnbamd_fsm.c[939] handle_req-Error creating acct session 7
never seen that but my interpretation would be, it never comes to a connection to the ldap server because of an error before. maybe wrong group/user setup on the FGT? so the posted config would never come into play, althoug looks like correct... regards
Not applicable

I' m working with LDAP as well. I am trying to check against group membership. Here is what I have for my LDAP Setup: edit " testldap" set server " 10.0.0.5" set cnid ' ' set dn " DC=dom,DC=edu" set type regular set username " CN=administrator,OU=users,DC=dom,DC=edu" set password XXXXXXXX set group " CN=ITStaff,OU=Administration,DC=dom,DC=edu" set filter ' ' and here is what the debug is giving me: MainCampus # fnbamd_fsm.c[460] handle_req-Rcvd auth req 1191 for tgrzeczk@dom.ed u in IPSec VPN LDAP opt=0 prot=5 fnbamd_auth.c[167] radius_start-Didn' t find radius servers (0) fnbamd_ldap.c[332] resolve_ldap_FQDN-Resolved address 10.0.0.5, result 10.0.0.5 fnbamd_ldap.c[667] fnbamd_ldap_get_result-Auth denied fnbamd_ldap.c[675] fnbamd_ldap_get_result-Going to DONE state res=1 fnbamd_auth.c[622] fnbamd_auth_poll-Result for ldap svr 10.0.0.5 is denied fnbamd_comm.c[137] fnbamd_comm_send_result-Sent result 1 for req 1191 Any help would be great.
ericlam
New Contributor

I' m working with LDAP as well. I am trying to check against group membership. Here is what I have for my LDAP Setup: edit " testldap" set server " 10.0.0.5" set cnid ' ' set dn " DC=dom,DC=edu" set type regular set username " CN=administrator,OU=users,DC=dom,DC=edu" set password XXXXXXXX set group " CN=ITStaff,OU=Administration,DC=dom,DC=edu" set filter ' ' and here is what the debug is giving me: MainCampus # fnbamd_fsm.c[460] handle_req-Rcvd auth req 1191 for tgrzeczk@dom.ed u in IPSec VPN LDAP opt=0 prot=5 fnbamd_auth.c[167] radius_start-Didn' t find radius servers (0) fnbamd_ldap.c[332] resolve_ldap_FQDN-Resolved address 10.0.0.5, result 10.0.0.5 fnbamd_ldap.c[667] fnbamd_ldap_get_result-Auth denied fnbamd_ldap.c[675] fnbamd_ldap_get_result-Going to DONE state res=1 fnbamd_auth.c[622] fnbamd_auth_poll-Result for ldap svr 10.0.0.5 is denied fnbamd_comm.c[137] fnbamd_comm_send_result-Sent result 1 for req 1191 Any help would be great.
If you' re using the default administrator user account to do the ldap query, it' s located in a Container, not an OU So your set username line should be: set username " CN=administrator,CN=users,DC=dom,DC=edu"
Not applicable

your cnid attribute is empty, so you have no attribute to chack against. you really should define a filter. with the provided username and password, can you bind to the ldap server with ldapsearch or a ldap browser tool? regards
CfSi_Dan
New Contributor

I was able to resolve my issue with some help from the Fortinet TAC. I was recieving the error:
fnbamd_fsm.c[934] handle_req-Rcvd 7 req fnbamd_acct.c[274] fnbamd_acct_start_STOP-Invalid params fnbamd_fsm.c[443] create_acct_session-Error start acct type 7 fnbamd_fsm.c[939] handle_req-Error creating acct session 7
This was being caused by firewall policy not having the correct user authentication method selected. The default is local, which is what I had my rule set at. I switched the selection to LDAP and everything worked. To troubleshoot whether or not credentials are being passed from the FGT to your LDAP server user the following command.
diag test authserver ldap <server_name> <username> <password>
Also, there is a good KC article on how to secure your LDAP traffic using IPSec from the FGT to your LDAP server. Fortigate KC Article Here' s another good article on how to secure Windows AD using certificates. This can be used for LDAPS on the FGT. Securing LDAP on Windows AD Finally a link to an excellent LDAP Browser Softerra LDAP Browser 2.6

Fortigate 200D HA A/P Cluster FAZ VM

Fortigate 200D HA A/P Cluster FAZ VM
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors