Setting LDAP Group Type from CLI

[wedda]

Hi All

I'm having issues authenticating against group membership with LDAP. I don't want to have to add each users accounts onto the firewall directly, so I've created a group on the LDAP server and added users to it. I've set the firewall to use group authentication, but I think because I'm using DS-389 (OpenLDAP Linux implementation) as an LDAP server the schema my be incorrect. As I'm doing my testing on a FortWiFi 40C lots of the configuration needs to be done on the CLI. The web interface manual for 5.2.1 shows a attribute "Group Type" explained as :

Indicate the schema of your LDAP directory, either: •OpenLDAP — The directory uses a schema where each user object’s group membership is recorded in an attribute named gidNumber. This is usually an OpenLDAP directory, or another directory where the object classinetOrgPerson or posixAccount. •Windows-AD — The directory uses a schema where each user object’s group membership is recorded in an attribute named memberOf. This is usually a Microsoft Active Directory server. •eDirectory — The directory uses a schema where each user object’s group membership is recorded in an attribute named groupMembership. This is usually a Novell eDirectory server.   But I see no way to set this in the CLI. Any idea's anyone. Thanks in advance. Paul

[techevo]

wedda wrote:

Hi All

I'm having issues authenticating against group membership with LDAP. I don't want to have to add each users accounts onto the firewall directly, so I've created a group on the LDAP server and added users to it. I've set the firewall to use group authentication, but I think because I'm using DS-389 (OpenLDAP Linux implementation) as an LDAP server the schema my be incorrect. As I'm doing my testing on a FortWiFi 40C lots of the configuration needs to be done on the CLI. The web interface manual for 5.2.1 shows a attribute "Group Type" explained as :

Indicate the schema of your LDAP directory, either: •OpenLDAP — The directory uses a schema where each user object’s group membership is recorded in an attribute named gidNumber. This is usually an OpenLDAP directory, or another directory where the object classinetOrgPerson or posixAccount. •Windows-AD — The directory uses a schema where each user object’s group membership is recorded in an attribute named memberOf. This is usually a Microsoft Active Directory server. •eDirectory — The directory uses a schema where each user object’s group membership is recorded in an attribute named groupMembership. This is usually a Novell eDirectory server. But I see no way to set this in the CLI. Any idea's anyone. Thanks in advance. Paul

I'm not aware of any way to do that so if someone can prove me wrong I would be very happy!  I tried for a while to use LDAP with some cheap NAS but figured out that the implementation on the Fortigate is in order to work with Microsoft AD.  So in order to make it work with open LDAP you need to be using the "memberof" overlay on your ldap server.  Also from what I understand it will apply only to memberships modified after you added the overlay.  I was stuck there since it was impossible for my product to recompile the open LDAP implementation with the overlay.  It should be a different story with a Linux server ( I'm not familiar with ds-389 specifics ) .  I found in my case, it was just easier to do it with radius instead which is what I did.

Let us know if you find anything.

[Jeff_FTNT]

FGT have two type group match.

1. "set group-member-check user-attr " , it will use "set member-attr " Name    of attribute from which to get group membership.  Here are some examples: memberOf for Windows AD and OpenLDAP (default) groupMembership for eDirectory

FGT send search request for "memberOf"  to LDAP server, and LDAP return the "memberOf " attriute. "memberOf" attribute support well on Windows AD, but for Linux OpenLdpa, by default , it did not support it, need add it manually.

2. "set group-member-check  group-object  ", it will use " set group-object-filter filter    used for group searching. Here are some examples: (&(objectcategory=group)(member=*)) (&(objectclass=groupofnames)(member=*)) (&(objectclass=groupofuniquenames)(uniquemember=*)) (&(objectclass=posixgroup)(memberuid=*)) FGT send search request for matching group-object-filter, LDAP return all member.

[wedda]

Great Thank You So Much. That worked like a dream. Final config for next person who wants to do the same thing.

config user ldap

    edit "ldap.Server.lan"         set server "192.168.128.150"         set cnid "uid"         set dn "dc=domain,dc=lan"         set type regular         set username "uid=FwLdapAdmin,ou=Administrators,ou=TopologyManagement,o=netscaperoot"         set password <FwLdapAdmin_Password>         set group-member-check group-object         set group-object-filter "(&(objectclass=groupofuniquenames)(uniquemember=*))" end

    edit "LDAP_FTC_Users"         set member "ldap.Server.lan"             config match                 edit 1                     set server-name "ldap.Server.lan"                     set group-name "cn=LDAP_FTC_Users,ou=Groups,dc=domain,dc=lan"                 next             end