LDAP groups vs FSSO

[PurpleShirt]

Hi Community

we currently use an LDAP server and import groups from there into fortigate user groups (create new user group -> add remote group from the LDAP server) that we use in SSL-VPN policies to grant access to the different ressources, that the users need to access. The users are also imported from the same LDAP Server in the same manner and we apply the 2FA settings afterwards. 

As soon as we rename the object in AD, then things start breaking, which makes sense, as the import is set to the string that is used to the value of the LDAP group when it is imported. 

I've seen that I can use the FSSO Collector Agent that allows me to directly use the LDAP Objects in my policies, without creating them localy. See this admin guide: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/795593

Now I wanted to know if this method would solve my problem with renaming groups. Would the firewall update the values of the used groups if I rename them in the LDAP server, without me having to either update something or re-add the group to the policies? The users would still be imported with the old way, as I have to apply the 2FA settings using FortiTokens that are stored on the firewall. 

Thank you. 

[pminarik · Accepted solution]

No, you will still have the same problem.

LDAP: outdated distinguished name referenced in a group, group used in a firewall policy

FSSO. outdated distinguished name declared in "config user adgrp". the same distinguished name used in a firewall policy.

The only realistic solution would be to track the groups based on their SID (never changes) instead of their name (can change), but such feature does not exist in FortiGate/FortiAuthenticator currently.

Alternative solution:

Create new groups with the specific purpose of being used only for the FortiGate's needs. Use these in your FortiGate configs, never rename them. In AD, set the "real groups" (which can sometimes get renamed) as members of these FortiGate-specific groups (nested membership).

This way, you should be able to keep everyone happy: FortiGate will have groups with static names, and whoever needs to rename their own groups can keep on renaming them. :)

[PurpleShirt]

Hi pminarik

Thank you for your response. Alright we have to think about a different way to do this then, but I'm glad that I know that it won't work, without me trying to implement it and then finding out that it doesn't solve my problem ^^