Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Yesolo
New Contributor II

Fortigate change username mapping from AD

When create users from LDAP server (in my case, Microsoft AD server), the ID (username on Fortigate) of created user is actually "display name" of this user in AD. The request is to change the username on Fortigate from this display name to "sAMAccountName" or "userPrincipalName". Is it possible? And how?

 

 

1 Solution
bpozdena_FTNT

Yes, it's possible to change. By default LDAP users will be imported based on their 'CN' attribute, which is usually the same as 'DisplayName'.

 

You will need to change the CNID value under your LDAP profile to change the behavior.

 

For instance, if you want your users to be imported with usernames based on the 'userPrincipalName' attribute, use the bellow configuration:

config user ldap
    edit "YOUR-LDAP-PROFILE-NAME"
        set cnid "userPrincipalName"
    next
end

 

If you want the imported usernames be based on the 'sAMAccountName', simply change the settings as bellow:

config user ldap
    edit "YOUR-LDAP-PROFILE-NAME"
        set cnid "sAMAccountName"
    next
end

 

Just note that after you change the value, you will need to delete and re-import all users again.

HTH,
Boris

View solution in original post

5 REPLIES 5
Yesolo
New Contributor II

Snapshot:7848310.png

Durga_Ashwath
Yesolo

Hi, thanks for the reply, but we don't have a FSSO Collector Agent now, we will try this later if other solutions don't work.

bpozdena_FTNT

Yes, it's possible to change. By default LDAP users will be imported based on their 'CN' attribute, which is usually the same as 'DisplayName'.

 

You will need to change the CNID value under your LDAP profile to change the behavior.

 

For instance, if you want your users to be imported with usernames based on the 'userPrincipalName' attribute, use the bellow configuration:

config user ldap
    edit "YOUR-LDAP-PROFILE-NAME"
        set cnid "userPrincipalName"
    next
end

 

If you want the imported usernames be based on the 'sAMAccountName', simply change the settings as bellow:

config user ldap
    edit "YOUR-LDAP-PROFILE-NAME"
        set cnid "sAMAccountName"
    next
end

 

Just note that after you change the value, you will need to delete and re-import all users again.

HTH,
Boris
Yesolo

Hi, it works, thank you very much!

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors