Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
gprentice
New Contributor

SSO on SSL-VPN Portal RDP using a domain (Fortigate 60E f/w ver=5.6.3)

When logging in manually to the RDP client, the domain is automatically selected, and the user logs in OK. (user does not have to specify the domain name)

 

However, when selecting SSO in the portal settings, clicking RDP fails login showing the local name of the server with the username.   We would like to use domain credentials, not local computer name credentials.

Tried making the domain default on the Windows Server 2012R2 server, but this problem still exists.

Any ideas?

8 REPLIES 8
Elthon_Abreu
Contributor

Hi gprentice,

 

If I got it well... You have a SSL VPN with LDAP/AD login. Right?

 

So, you want to log in to SSL VPN Portal and access an RDP environment with the same LDAP user. I have a similar demand and I use my login username like "username@domain.net" + password, or I configure a bookmark in Portal template.

 

I hope it helps.

 

Cheers,

Elthon Abreu

Elthon Abreu FCNSA v5

Elthon Abreu FCNSA v5
gprentice

Thanks, that might be a good workaround, but I was hoping it would be simpler for the users (who sometimes have trouble remembering their username, let alone a domain name too)

 

Graham

Elthon_Abreu

Graham,

 

Try the second option... configure your Portal template with SSO... that will "use" the same login of VPN logon. It works for me... my users just click on bookmark link and the RDP session opens.

 

Cheers,

Elthon Abreu FCNSA v5

Elthon Abreu FCNSA v5
Valentin

gprentice wrote:

Thanks, that might be a good workaround, but I was hoping it would be simpler for the users (who sometimes have trouble remembering their username, let alone a domain name too)

 

Graham

Hello,

 

Same issue here !! I have tried everything... :(

 

Did you find a solution ? 

 

Thanks for your help.

 

Valentin

GabrielSanchez
New Contributor

I have the same issue on a FG200E running 6.0.4. I also tried forcing the default domain using GPO, but did not resolved the issue.

 

This is what worked for me:

1. On the server that you are trying to RDP to, make sure you force to use NLA.

 

2. on the Bookmark, select SSO and let the server pick the security.

 

 

Hope this helps,

Gabriel

 

(Updated to remove pics - sorry new to this forum)

GabrielSanchez

I was having issues with remote accounts that have "Log On To" restrictions in AD (Consultants).

 

The solution was to add a DNS host entry for the FG host name and add the FG name to the computers the user is allowed to logon. 

 

For example;

 

System->Setting

    Host name: MyFirewall

 

Network->Interfaces

     Port 1: 172.1.1.1/24   (This is my LAN interface that talks to AD - LDAP)

 

In my DNS server (AD), I added a host record;

    MyFireall   --> 172.1.1.1

 

in Users And Computers (AD) I added "MyFirewall" to the "Log On To" list ( Open user in AD, go to the Account tab to find the option)

 

achavira1423

Thanks man, works for me!

FGT 100D 6.0.3

AlexeyU

If user have resticted access via Account -> Log on to - add DNS-name of FGT does't work for me

 

Solved by add domain controller, that's strange.. 

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors