Creating the directory tree

The following sections provide a brief explanation of each part of the LDAP attribute directory, what is commonly used for representation, and how to configure it on FortiAuthenticator.

When an object name includes a space, as in Test Users, you have to enclose the text with double-quotes. For example: cn="TesTUsers",cn=Builtin,dc=get,dc=local.

x

Editing the root node

The root node is the top level of the LDAP directory. There can be only one. All groups, OUs, and users branch off from the root node. Choose a DN that makes sense for your organization’s root node.

There are three common forms of DN entries:

The most common consists of one or more DC elements making up the DN. Each part of the domain has its own DC entry. This comes directly from the DNS entry for the organization. For example, for example.com, the DN entry is "dc=example,dc=com".

Another popular method is to use the company’s Internet presence as the DN. This method uses the domain name as the DN. For example, for example.com, the DN entry would be "o=example.com".

An older method is to use the company name with a country entry. For example, for Example Inc. operating in the United States, the DN would be o="Example, Inc.",c=US. This makes less sense for international companies.

When you configure FortiGate units to use FortiAuthenticator as an LDAP server, you will specify the distinguished name that you created here. This identifies the correct LDAP structure to reference.

To rename the root node:

1. Go to Authentication > LDAP Service > Directory Tree.
2. Select dc=example,dc=com to edit the entry.
3. In the Distinguished Name (DN) field, enter a new name (e.g. "dc=fortinet,dc=com").
4. Select OK to apply your changes.

   If your domain name has multiple parts to it, such as shiny.widgets.example.com, each part of the domain should be entered as part of the DN, for example: dc=shiny,dc=widgets,dc=example,dc=com

Adding nodes to the LDAP directory tree

You can add a subordinate node at any level in the hierarchy as required.

To add a node to the tree:

1. From the LDAP directory tree, select the green plus symbol next to the DN entry where you want to add the node.
   The Create New LDAP Entry window opens.
2. In the Class field, select the identifier to use.

For example, to add the ou=People node from the earlier example, select Organizational Unit (ou).

3. Select the required value from the dropdown menu, or select Create New to create a new entry of the selected class.
4. Select OK to add the node.

Nodes can be edited after creation by selecting the edit, or pencil, icon next to the node name.

Adding user accounts to the LDAP tree

You must add user account entries at the appropriate place in the LDAP tree. These users must already be defined in the FortiAuthenticator user database. See Adding a user.

To add a user account to the tree:

1. From the LDAP directory tree, expand nodes as needed to find the required node, then select the node’s green plus symbol.

In the earlier example, you would do this on the ou=People node.

2. In the Class field, select User (uid).

The list of available users is displayed. You can choose to display them alphabetically by either user group or user.

3. Select the required users in the Available Users box and move them to the Chosen Users box. If you want to add all local users, select Choose all below the users box.
4. Select OK to add the user account to the tree.
   You can verify your users were added by expanding the node to see their UIDs listed below it.

Moving LDAP branches in the directory tree

At times you may want to rearrange the hierarchy of the LDAP structure. For example a department may be moved from one country to another.

While it is easy to move a branch in the LDAP tree, all systems that use this information will need to be updated to the new structure or they will not be able to authenticate users.

To move an LDAP branch:

1. From the LDAP directory tree, select Expand All and find the branch that you want to move.
2. Click and drag the branch from its current location to its new location

When the branch is hovered above a valid location, an arrow appears to the left of the current branch to indicate where the new branch will be inserted. It will be inserted below the entry with the arrow.

Removing entries from the directory tree

Adding entries to the directory tree involves placing the attribute at the proper place. However, when removing entries it is possible to remove multiple branches at one time.

Take care not to remove more branches than you intend. Remember that all systems using this information will need to be updated to the new structure or they will not be able to authenticate users.

To remove an entry from the LDAP directory tree:

1. From the LDAP directory tree, select Expand All and find the branch that you want to remove.
2. Select the red X to the right of the entry name.

You are prompted to confirm your deletion. Part of the prompt displays the message of all the entries that will be removed with this deletion. Ensure this is the level that you intend to delete.

3. Select Yes, I’m sure to delete the entry.
   If the deletion was successful there is a green check next to the successful message above the LDAP directory and the entry is removed from the tree.