Technical Note: LDAP Nested Group authentication for SSLVPN

[Somashekara_Hanumant]

Description

This article concerns LDAP authentication when groups are nested.

For example, User group DN is binded with:

CN=VPN, OU=Group, OU=1-Main Organization, DC=example, DC=local

and the actual user 'TestUser' belongs to another group, say 'IT Group' where 'IT Group' is a member of VPN group.

When the user tries to login to sslvpn webportal using 'TestUser', authentication will be denied, and the message on the SSLVPN debug would be:

"Auth failed due to group restrictions"

The actual user group DN will be shown.

When trying to login from the FortiGate CLI console, authentication succeeds.

Solution

Configure the following commands on the LDAP, it should be allow all the nested group information to be retrieved.

config user ldap
edit "example.local"
set group-member-check user-attr
set search-type nested
next
end

A query from the FortiGate CLI console should now show the nested group correctly.