SSLVPN LDAP Authentication failed - error 34

[SteveF]

Hello,

I recently have an issue with LDAP authentication on SSLVPN. 

On GUI I tried to test user credential and it's work but when I tried to debug fnamd application, the authentication failed with error 34 : 

Forti-1 (SSL_VPN) # diagnose test authserver ldap LDAP_SOSM steve.fillatreau password [1936] handle_req-Rcvd auth req 1577524297 for steve.fillatreau in LDAP_SOSM opt=0000001b prot=0 [424] __compose_group_list_from_req-Group 'LDAP_SOSM', type 1 [616] fnbamd_pop3_start-steve.fillatreau [976] __fnbamd_cfg_get_ldap_list_by_server- [982] __fnbamd_cfg_get_ldap_list_by_server-Loaded LDAP server 'LDAP_SOSM' [1137] fnbamd_cfg_get_ldap_list-Total ldap servers to try: 1 [1715] fnbamd_ldap_init-search filter is: sAMAccountName=steve.fillatreau [1724] fnbamd_ldap_init-search base is: DC=sosm\2C DC=lan [1146] __fnbamd_ldap_dns_cb-Resolved LDAP_SOSM:172.17.100.100 to 172.17.100.100, cur stack size:1 [919] __fnbamd_ldap_get_next_addr- [1152] __fnbamd_ldap_dns_cb-Connection starts LDAP_SOSM:172.17.100.100, addr 172.17.100.100 [874] __fnbamd_ldap_start_conn-Still connecting 172.17.100.100. [591] create_auth_session-Total 1 server(s) to try [1103] __ldap_connect-tcps_connect(172.17.100.100) is established. [981] __ldap_rxtx-state 3(Admin Binding) [320] __ldap_build_bind_req-Binding to 'SOSM\4G.auth' [1041] fnbamd_ldap_send-sending 40 bytes to 172.17.100.100 [1053] fnbamd_ldap_send-Request is sent. ID 1 [981] __ldap_rxtx-state 4(Admin Bind resp) [1084] __fnbamd_ldap_read-Read 8 [1084] __fnbamd_ldap_read-Read 14 [1264] fnbamd_ldap_recv-Response len: 16, svr: 172.17.100.100 [945] fnbamd_ldap_parse_response-Got one MESSAGE. ID:1, type:bind [980] fnbamd_ldap_parse_response-ret=0 [1048] __ldap_rxtx-Change state to 'DN search' [981] __ldap_rxtx-state 11(DN search) [708] fnbamd_ldap_build_dn_search_req-base:'DC=sosm\2C DC=lan' filter:sAMAccountName=steve.fillatreau [1041] fnbamd_ldap_send-sending 84 bytes to 172.17.100.100 [1053] fnbamd_ldap_send-Request is sent. ID 2 [981] __ldap_rxtx-state 12(DN search resp) [1084] __fnbamd_ldap_read-Read 8 [1084] __fnbamd_ldap_read-Read 94 [1264] fnbamd_ldap_recv-Response len: 96, svr: 172.17.100.100 [945] fnbamd_ldap_parse_response-Got one MESSAGE. ID:2, type:search-result [style="background-color: #ffff00;"][967] fnbamd_ldap_parse_response-Error 34(0000208F: LdapErr: DSID-0C090787, comment: Error processing name, data 0, v1db1)[/style] [980] fnbamd_ldap_parse_response-ret=34 [785] __ldap_done-svr 'LDAP_SOSM' [755] __ldap_destroy- [style="background-color: #ffff00;"][725] __ldap_stop-Conn with 172.17.100.100 destroyed.[/style] [217] fnbamd_comm_send_result-Sending result 1 (nid 0) for req 1577524297, len=1960 [747] destroy_auth_session-delete session 1577524297 [755] __ldap_destroy- [1721] fnbamd_ldap_auth_ctx_free-Freeing 'LDAP_SOSM' ctx authenticate 'steve.fillatreau' against 'LDAP_SOSM' failed!

I'm running FortiOS 6.4.2 and Windows Server 2008 R2.

Thank you.

Best regards.

[Andrew_S]

Hello!

You must remove the spaces between the dc entries in the "distinguished name" field in the LDAP profile. For example, the field should contain the following entry: dc=domain,dc=local