Trouble with LDAP authentication

[locaol]

Hello,

I'm facing a trouble with setting up the LDAP authentication: my LDAP server seems to be well configured, Connectivity and User Credentials works from the GUI.

From console, I try:

diagnose test authserver ldap "LDAP TEST" ldapreader password
diagnose test authserver ldap "LDAP TEST" myaccount password

ldapreader is the username setted for the connection to LDAP, myaccount is my username.

Each time I get : authenticate 'account' against 'LDAP TEST' failed! (account is the account I test)

I'd tried many settings for the User group, adding my user (from ldap) or adding a remote group in which I am, it doesn't work.

Product: Fortigate v7.4.4

[AEK]

Hello

Your syntax is correct.

In case the password contains special characters, can you just try put it between quotes?

[maulishshah]

Hello @locaol ,

Can you please follow this article to identify the reason? 

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-FortiGate-LDAP-troubleshooting-and-d...

Please run the following commands to identify what could be the reason for failed authentication.

FGT# diagnose debug enable
FGT# diagnose debug application fnbamd 255

Note: Then run your test

diagnose test authserver ldap "LDAP TEST" ldapreader password

Thank you. 

[locaol]

I think the trouble is with the ldap certificate:

[1666] __verify_cb-Cert error 20, unable to get local issuer certificate. Depth 0. Subject '/CN=MYAD01.domain.dmn'
[1345] __ldap_tcps_connect-tcps_connect(192.168.1.1) failed: ssl_connect() failed: 167772294 (error:0A000086:SSL routines::certificate verify failed).

I'll try to correct that.

The strange thing is that when I use the GUI, it works, using starttls or ldaps.

[maulishshah]

Hi, Can you please provide the configuration of LDAP server? 

show user ldap 

[locaol]

Here is how it's configured when trying with starttls :

# show user ldap
config user ldap
    edit "LDAP TEST"
        set server "192.168.1.1"
        set secondary-server "192.168.1.2"
        set source-ip "192.168.1.254"
        set cnid "sAMAccountName"
        set dn "ou=mybusiness,dc=domain,dc=dmn"
        set type regular
        set username "ldapreader"
        set password ENC *** obfuscated ****
        set secure starttls
    next
end

And when I try with ldaps:

# show user ldap
config user ldap
    edit "LDAP TEST"
        set server "192.168.1.1"
        set secondary-server "192.168.1.2"
        set source-ip "192.168.1.254"
        set cnid "sAMAccountName"
        set dn "ou=mybusiness,dc=domain,dc=dmn"
        set type regular
        set username "ldapreader"
        set password ENC *** obfuscated ****
        set secure ldaps
        set port 636
    next
end

Both works when I use the GUI to check connectivity and user credential, but not when I use the console or try to authenticate with FortiClient VPN.

[maulishshah]

Hi,

The best you can open a support case and the engineer will take control to check pcap to verify what would be the reason with LDAPs or LDAP. 

Or 

You can run pcap for host 

192.168.1.1

Here is the KB article to run wireshark logs: https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-run-a-real-time-Wireshark-capture-o...

Thank you. 

[ndumaj · Accepted solution]

Hello @locaol 

Starting from FGT 7.4.4 the FGT requires Root CA (issuer) to be uploaded to the FGT, please review the following article:
https://community.fortinet.com/t5/FortiGate/Technical-Tip-LDAPS-STARTTLS-certificate-issuer-enforcem...

Also, self-signed certificates cannot be verified by FGT.

BR

[locaol]

This was exactly the solution. Thanks a lot

[salmas]

Hello @locaol ,

You can try another syntax just for testing and put the password between quotes as @AEK suggested.

diagnose test authserver ldap LDAP\ TEST ldapreader "password"