Fortinet black logo

Administration Guide

Configuring an LDAP server

Configuring an LDAP server

FortiOS can be configured to use an LDAP server for authentication.

To configure an LDAP server on the FortiGate:
  1. Go to User & Authentication > LDAP Servers.
  2. Click Create New.
  3. Configure the following:

    Name

    This connection name is for reference within the FortiGate only.

    Server IP/Name

    LDAP server IP address or FQDN resolvable by the FortiGate.

    Server Port

    By default, LDAP uses port 389 and LDAPS uses 636. Use this field to specify a custom port if necessary.

    Common Name Identifier

    Attribute field of the object in LDAP that the FortiGate uses to identify the connecting user. The identifier is case sensitive. Common attributes are:

    • cn (Common Name)
    • sAMAccountName (SAMAccountName)
    • uid (User ID)

    Distinguished Name

    Used to look up user account entries on the LDAP server. It reflects the hierarchy of LDAP database object classes above the CN identifier in which you are doing the lookup.

    Enter dc=COMPANY,dc=com to specify the root of the domain to include all objects.

    Enter ou=VPN-Users,dc=COMPANY,dc=com to look up users under a specific organization unit.

    Exchange server

    Enable to specify the exchange server connector to collect information about authenticated users from a corporate exchange server. See Exchange Server connector for more details.

    Bind Type

    Select one of the following options:

    • Simple: bind using simple password authentication using the client name. The LDAP server only looks up against the distinguished name (DN), but does not search on the subtree.
    • Anonymous: bind using an anonymous user, and search starting from the DN and recurse over the subtrees. Many LDAP servers do not allow this.
    • Regular: bind using the username and password provided, and search starting from the DN and recurse over the subtrees.

    Username

    If using regular bind, enter a username with sufficient privileges to access the LDAP server. The following formats are supported:

    • username\administrator
    • administrator@domain
    • cn=administrator,cn=users,dc=domain,dc=com

    Password

    If using regular bind, enter the password associated with the username.

    Secure Connection

    Enable to apply security to the LDAP connection through STARTTLS or LDAPS.

    Protocol

    If Secure Connection is enabled, select STARTTLS or LDAPS. Selecting STARTTLS changes the port to 389 and selecting LDAPS changes the port to 636.

    Certificate

    Enable and select the certificate so the FortiGate will only accept a certificate from the LDAP server that is signed by this CA.

    Server identity check

    Enable to verify the server domain or IP address against the server certificate. This option is enabled by default and it is recommended to leave it enabled for a secure configuration.

    Note

    When specifying a secure connection, there are some considerations for the certificate used by LDAP to secure the connection. The FortiGate checks the certificate presented by the LDAP server for the IP address or FQDN as specified in the Server IP/Name field with the following logic:

    • If there is a Subject Alternative Name (SAN), it will ignore any Common Name (CN) value and look for a match in any of the SAN fields.
    • If there is no SAN, it will check the CN for a match.
  4. Optionally, click Test User Credentials to ensure that the account has sufficient access rights.

  5. Click OK.

    The FortiGate checks the connection and updates the Connection Status.

Configuring an LDAP server

FortiOS can be configured to use an LDAP server for authentication.

To configure an LDAP server on the FortiGate:
  1. Go to User & Authentication > LDAP Servers.
  2. Click Create New.
  3. Configure the following:

    Name

    This connection name is for reference within the FortiGate only.

    Server IP/Name

    LDAP server IP address or FQDN resolvable by the FortiGate.

    Server Port

    By default, LDAP uses port 389 and LDAPS uses 636. Use this field to specify a custom port if necessary.

    Common Name Identifier

    Attribute field of the object in LDAP that the FortiGate uses to identify the connecting user. The identifier is case sensitive. Common attributes are:

    • cn (Common Name)
    • sAMAccountName (SAMAccountName)
    • uid (User ID)

    Distinguished Name

    Used to look up user account entries on the LDAP server. It reflects the hierarchy of LDAP database object classes above the CN identifier in which you are doing the lookup.

    Enter dc=COMPANY,dc=com to specify the root of the domain to include all objects.

    Enter ou=VPN-Users,dc=COMPANY,dc=com to look up users under a specific organization unit.

    Exchange server

    Enable to specify the exchange server connector to collect information about authenticated users from a corporate exchange server. See Exchange Server connector for more details.

    Bind Type

    Select one of the following options:

    • Simple: bind using simple password authentication using the client name. The LDAP server only looks up against the distinguished name (DN), but does not search on the subtree.
    • Anonymous: bind using an anonymous user, and search starting from the DN and recurse over the subtrees. Many LDAP servers do not allow this.
    • Regular: bind using the username and password provided, and search starting from the DN and recurse over the subtrees.

    Username

    If using regular bind, enter a username with sufficient privileges to access the LDAP server. The following formats are supported:

    • username\administrator
    • administrator@domain
    • cn=administrator,cn=users,dc=domain,dc=com

    Password

    If using regular bind, enter the password associated with the username.

    Secure Connection

    Enable to apply security to the LDAP connection through STARTTLS or LDAPS.

    Protocol

    If Secure Connection is enabled, select STARTTLS or LDAPS. Selecting STARTTLS changes the port to 389 and selecting LDAPS changes the port to 636.

    Certificate

    Enable and select the certificate so the FortiGate will only accept a certificate from the LDAP server that is signed by this CA.

    Server identity check

    Enable to verify the server domain or IP address against the server certificate. This option is enabled by default and it is recommended to leave it enabled for a secure configuration.

    Note

    When specifying a secure connection, there are some considerations for the certificate used by LDAP to secure the connection. The FortiGate checks the certificate presented by the LDAP server for the IP address or FQDN as specified in the Server IP/Name field with the following logic:

    • If there is a Subject Alternative Name (SAN), it will ignore any Common Name (CN) value and look for a match in any of the SAN fields.
    • If there is no SAN, it will check the CN for a match.
  4. Optionally, click Test User Credentials to ensure that the account has sufficient access rights.

  5. Click OK.

    The FortiGate checks the connection and updates the Connection Status.