Help
Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Rig
New Contributor

Created on ‎09-08-2016 05:33 AM

SSO issues/problems

Hi all

I am new to Fortigate (this is also my 1st post to the forum) and attempted to setup FSSO. I followed the steps as described in this link (http://cookbook.fortinet.com/providing-single-sign-using-ldap-fsso-agent-advanced-mode-expert/), hiowever after completing all the steps - I can see the logins from my users in the FSSO agent installed on the DC, however I am seeing nothing on Fortigate. There is no user entry under "User & Device > Monitor > Firewall" - and from CLI I get the below: 

# diagnose debug authd fsso list
----FSSO logons----
Total number of logons listed: 0, filtered: 0
----end of FSSO logons----
Did I miss something or do something wrong? Any advice welcome.

54121
0 Kudos
1 Solution
xsilver_FTNT
Staff
Staff

Created on ‎09-14-2016 02:46 AM

As you set up standalone Collector Agent on DC (if you followed cookbook receipt), then you do not need Local FSSO poller on FortiGate .. remove it from 'config user fsso-polling'.

Make sure that your fsso 'config user adgrp' records are paired to  right Collector "TCMVPN-FSSO" and not to local poller.

 

Then check users in Collector / Show Logon Users and their group membership. It seems to me probable that they are not matching group filters set and therefore they are not reported to FortiGate. Check Group Filters on Collector and on FortiGate. If you run in advanced mode then filters should be in LDAP format like "CN=group,DC=example,DC=com". Also make sure that you have selected LDAP objects which are actually groups (they must have LDAP ObjectClass=group) and not users or anything else!

Tomas Stribrny - NASDAQ:FTNT - Fortinet Inc. - TAC Staff Engineer
AAA, MFA, VoIP and other Fortinet stuff

View solution in original post

22269
0 Kudos
11 REPLIES 11
Armando_Gomez_Barrio
New Contributor III
In response to CorneJvV

Created on ‎11-07-2018 03:48 PM 

Hello, you managed to solve this problem

I have a problem with the FSSO, your same problem, I would appreciate any support

Best Regrads

Armando Gómez
Armando Gómez
Armando Gómez
1986
0 Kudos
imanet
New Contributor

Created on ‎09-23-2019 10:21 AM

Hi if you want to config fsso in polling mode first you just need an active directory user which member of  "domain users" and "event log reader" group

second if you have number of active directory server JUST select the one which has a global catalog role

this method is very simple an connect immediately after you refresh the page

1986
0 Kudos
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors
View all
Broad. Integrated. Automated.

The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.

Social Media
Security Research
Company
News & Articles
Contact Us

Copyright 2024 Fortinet, Inc. All Rights Reserved.