Hello,
I'm facing a trouble with setting up the LDAP authentication: my LDAP server seems to be well configured, Connectivity and User Credentials works from the GUI.
From console, I try:
diagnose test authserver ldap "LDAP TEST" ldapreader password
diagnose test authserver ldap "LDAP TEST" myaccount password
ldapreader is the username setted for the connection to LDAP, myaccount is my username.
Each time I get : authenticate 'account' against 'LDAP TEST' failed! (account is the account I test)
I'd tried many settings for the User group, adding my user (from ldap) or adding a remote group in which I am, it doesn't work.
Product: Fortigate v7.4.4
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hello @locaol
Starting from FGT 7.4.4 the FGT requires Root CA (issuer) to be uploaded to the FGT, please review the following article:
https://community.fortinet.com/t5/FortiGate/Technical-Tip-LDAPS-STARTTLS-certificate-issuer-enforcem...
Also, self-signed certificates cannot be verified by FGT.
BR
Hello
Your syntax is correct.
In case the password contains special characters, can you just try put it between quotes?
Hello @locaol ,
Can you please follow this article to identify the reason?
Please run the following commands to identify what could be the reason for failed authentication.
FGT# diagnose debug enable
FGT# diagnose debug application fnbamd 255
Note: Then run your test
diagnose test authserver ldap "LDAP TEST" ldapreader password
Thank you.
I think the trouble is with the ldap certificate:
[1666] __verify_cb-Cert error 20, unable to get local issuer certificate. Depth 0. Subject '/CN=MYAD01.domain.dmn'
[1345] __ldap_tcps_connect-tcps_connect(192.168.1.1) failed: ssl_connect() failed: 167772294 (error:0A000086:SSL routines::certificate verify failed).
I'll try to correct that.
The strange thing is that when I use the GUI, it works, using starttls or ldaps.
Hi, Can you please provide the configuration of LDAP server?
show user ldap
Here is how it's configured when trying with starttls :
# show user ldap
config user ldap
edit "LDAP TEST"
set server "192.168.1.1"
set secondary-server "192.168.1.2"
set source-ip "192.168.1.254"
set cnid "sAMAccountName"
set dn "ou=mybusiness,dc=domain,dc=dmn"
set type regular
set username "ldapreader"
set password ENC *** obfuscated ****
set secure starttls
next
end
And when I try with ldaps:
# show user ldap
config user ldap
edit "LDAP TEST"
set server "192.168.1.1"
set secondary-server "192.168.1.2"
set source-ip "192.168.1.254"
set cnid "sAMAccountName"
set dn "ou=mybusiness,dc=domain,dc=dmn"
set type regular
set username "ldapreader"
set password ENC *** obfuscated ****
set secure ldaps
set port 636
next
end
Both works when I use the GUI to check connectivity and user credential, but not when I use the console or try to authenticate with FortiClient VPN.
Hi,
The best you can open a support case and the engineer will take control to check pcap to verify what would be the reason with LDAPs or LDAP.
Or
You can run pcap for host
192.168.1.1
Here is the KB article to run wireshark logs: https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-run-a-real-time-Wireshark-capture-o...
Thank you.
Hello @locaol
Starting from FGT 7.4.4 the FGT requires Root CA (issuer) to be uploaded to the FGT, please review the following article:
https://community.fortinet.com/t5/FortiGate/Technical-Tip-LDAPS-STARTTLS-certificate-issuer-enforcem...
Also, self-signed certificates cannot be verified by FGT.
BR
This was exactly the solution. Thanks a lot
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1696 | |
1091 | |
752 | |
446 | |
228 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.