SSO options for Linux Desktops.

[eby]

I have couple of Linux Desktops(Ubuntu 22.04 LTS and Linux Mint LTS versions) that need to use SSO for internet access and other networks. On Fortigate static ip based rules are used for these Linux desktops. These linux desktops are joined to Windows AD thru "sssd" and domain based user login is enabled. However these systems do not show up in FSSO Agent when logged in with AD user name.

FSSO agent mode = DC Agent mode.

On AD, the users are in correct OU and Group.

Are Linux clients supported on FSSO ?.

What are my options to resolve this with other than RSSO or any other Fortinet Products?.

Thanks in Advance,

[eby]

Hi Debbie,

Many thanks for these  FSSO Agent tips, really appreciate.

I have created "allow_dollar_sign_in_usernames" DWORD and set value to "1" in HKEY_LOCAL_MACHINE\software\wow6432node\fortinet\fsae\collectoragent.

Now DC Agent logs show two entries, first entry with "domain\hostname" and second entry with "domain\username", and the same old 4769 AD events ID. Still linux system not listed on "Show Logon Users" on FSSO agent.

We also see "machine account:<hostname>$ is ignored" entries for  windows logins, these are from previous and current DC Agent debug logs.

------------------------------

06/04/2024 12:55:00.553: processing Logon (level=1, logonid=0-0) domain\hostname$ () from (null)

Ignore logon event without workstation information.

06/04/2024 12:55:00.569: finish processing.
Msv1_0SubAuthenticationFilter is called

06/04/2024 12:55:00.694: processing Logon (level=1, logonid=0-0) domain\username (Eby Mani) from (null)

Ignore logon event without workstation information.

06/04/2024 12:55:00.709: finish processing.
Msv1_0SubAuthenticationFilter is called

------------------------------

A Kerberos service ticket was requested.

TargetUserName <hostname>$@<domain>
TargetDomainName <domain>
ServiceName krbtgt/<domain>
ServiceSid S-1-0-0
TicketOptions 0x60000000
TicketEncryptionType 0xffffffff
IpAddress ::ffff:<local ipv4>
IpPort 41842
Status 0xd
LogonGuid {00000000-0000-0000-0000-000000000000}
TransmittedServices -

------------------------------

I will try to integrate ubuntu with winbind, instead of sssd and test if that make any difference.

Thanks,

[AnthonyL]

Hi, I’m interested about this issue because I have the same case to fix. Did you find a solution ?

[eby]

Found a solution.

1. Windows Server FSSO - Polling Mode with Poll logon sessions using Windows NetAPI.
2. Ubuntu - Windows AD integration using winbind (have done fresh OS install without sssd components)

On DNS server, manual A record need to be created for linux hosts, else will get “No DNS domain configured for <hostname>. Unable to perform DNS Update.
DNS update failed: NT_STATUS_INVALID_PARAMETER” while joining domain on linux host.

winbind require manual configuration of nsswitch.conf, smb.conf, and krb5.conf files.

On smb.conf, idmap config must use "rid" as backend.

Hope this helps anyone looking to resolve this issue.

Thanks,

[Arth33]

Hello,

Thanks a lot for help about this issue.
How do you handle, connection change, wired to wifi to vpn ...

What command line do you use to force, fsso login ?
Do you have any delay or is it immediate ?

Thanks very much !

[eby]

Use RADIUS for wireless and vpn.

If possible, use .1x with RSSO for wired authentication, thus you can avoid AD/FSSO related complications.

Not forcing any additional command line on linux. Default local user is used only for system maintenance, FSSO reads AD user login on linux and sends to Fortigate. Perhaps you can omit $ on FSSO config to facilitate access for linux local users (i have not tested this), check Debbies FSSO Agent tips.

I have not observed any FSSO delay with Linux clients.

The only caveat is updating DNS entries for linux desktops on AD Server, if you have separate DHCP and DNS server. This can be done thru script on linux clients or on linux DHCP/DNS server.

[Brielle564]

---

@eby wrote:

I have couple of Linux Desktops(Ubuntu 22.04 LTS and Linux Mint LTS versions) that need to use SSO for internet access and other networks. On Fortigate static ip based rules are used for these Linux desktops. These linux desktops are joined to Windows AD thru "sssd" and domain based user login is enabled. However these systems do not show up in FSSO Agent when logged in with AD user name.

FSSO agent mode = DC Agent mode.

On AD, the users are in correct OU and Group.

Are Linux clients supported on FSSO ?.

What are my options to resolve this with other than RSSO or any other Fortinet Products?.

Thanks in Advance,

---

Linux clients are not directly supported by Fortinet's FSSO (Fortinet Single Sign-On) in DC Agent mode. FSSO primarily works with Windows-based clients.