SSO and LDAP Configuration for Office365-only organization

Marzigliano · ‎01-12-2017

We're configuring our first/new FortiGate device and need to connect in users on the LDAP/RADIUS and SSO pages. There is no local server, AD, or domain controller presence in the organization, as they exclusively use Office 365, so we are trying to configure the FortiGate to connect to Office 365 or Azure for the LDAP/RADIUS and SSO configuration. We've been scouring the documentation/help at Fortinet and at Microsoft but to no avail. We will face a similar challenge next week with an org that has only G-Suite users and no local servers either.

v20100 · ‎02-12-2019

We are assuming that Domain Services and LDAPS is properly configured in Azure

On FG, for ldap server, make sure you use port 636

Common Name Identifier: sAMAccountName

Use your DN

Bind type: Regular

Username: use company\username syntax.

If you use username or username@companydomainname it does not work

Secure Connection: selected

Protocol LDAPS

No certificate

Check that the connection is successful and if you are on version 6, test a user credential from there.

No point to carry on, if you connection is not successful

When you create your User group, use the previously created LDAP server.

If like me, you want to restrict access to a particular user group, on your Recursive list, select OU=AADDC Users, and search for your required group. Once found, you need to right click on it to select it.

The next step is the one which tricked me for a couple of days:

When you try Forticlient, it fails to authenticate. Error message is not helping and there is nothing in the logs of interest. Of course, there is nothing either on AzureAD

The change to make it work is as follow on the FG:

config system global

set ldapconntimeout 5000

end

Also, on the Forticlient, username is shortname of UPN. If user uses full UPN it will fail. You can see these attempts in the logs

Good luck

View solution in original post

dcook · ‎02-15-2019

I just went through figuring this out today with some trial and error. Here is what worked for my setup.

I'm on FortiOS v6.0.4 build0231 (GA)

This is for Azure AD with no local domain sync enabled. Make sure domain services is set up and ldaps is configured with a proper certificate. Also don't forget to set AADS NSG rules to allow ldaps on port 636 from your firewall IP. Edit the global settings for a longer ldap connection timeout to 5000 config system global set ldapconntimeout 5000 Set up a LDAP server Name AzureAD Server IP/Name your.ldap.name Server Port 636 Common Name Identifier userPrincipalName Distinguished Name ou=AADDC Users,dc=company,dc=com Bind Type Regular Username &nbsp bind@company.com (The bind account needs to be in the AAD DC Administrators group) Password userpassword Secure Connection checked to on Protocol ldaps Certificate none Test Connectivty and then Test User Credentials. The username is their primary email address. test@company.com If you have Office 365 MFA enabled it will fail. I haven't found anyway to auth a user successfully with MFA enabled. Go to User Groups and do not create a new user group. Select local and add a Remote Group. Add the ldap server from above as the Remote Server. Select the ldap group the vpn user are in. Make sure you right click on the grou and hit + Add Selected. In SSL-VPN Settings under Authentication/Portal Mapping add the local group to the Portal full-access if your users are going to have full tunnel access.

View solution in original post

baker_gt · ‎04-09-2019

Thanks for this guys, i have got it all working with the help of

https://docs.microsoft.com/en-us/azure/active-directory-domain-services/active-directory-ds-admin-gu...

But the costs are crazy. $150 AUD a month to do some LDAPS lookups are a bit rich!

Schubawi · ‎03-11-2020

Is Fortigate Looking at these Posts?

the Organizations are moving off onsite AD servers and SSO to O365 or G Suite will be beneficial for FortiOS,

For Instance NZ Schools have just implemented fortigates to every school and the MSP's are moving away from local ad due to cost saving requirements,

but they cant if they require user identification

Schubawi · ‎03-11-2020

This will Work if you deploy a Fortiauthenticator to your network,

https://docs.fortinet.com/document/fortiauthenticator/6.0.3/administration-guide/641286/remote-authe...

I dont see Fortinet adding a Function in their firewalls to remove a device in their product stack

It would be a nice to have. if Fortinet is Looking to sell a Fortigate "with SAML, or OAUTH" at a nice price

ArnaudF · ‎04-08-2020

Fortigate already support SAML as SP for firewall and SSL VPN web portal authentication https://docs.fortinet.com/document/fortigate/6.4.0/new-features/558169/saml-sp-for-vpn-authenticatio... :)