FortiOS can be configured to use an LDAP server for authentication.
- Go to User & Authentication > LDAP Servers.
- Click Create New.
- Configure the following:
This connection name is for reference within the FortiGate only.
LDAP server IP address or FQDN resolvable by the FortiGate.
By default, LDAP uses port 389 and LDAPS uses 636. Use this field to specify a custom port if necessary.
Common Name Identifier
Attribute field of the object in LDAP that the FortiGate uses to identify the connecting user. The identifier is case sensitive. Common attributes are:
- cn (Common Name)
- sAMAccountName (SAMAccountName)
- uid (User ID)
Used to look up user account entries on the LDAP server. It reflects the hierarchy of LDAP database object classes above the CN identifier in which you are doing the lookup.
Enter dc=COMPANY,dc=com to specify the root of the domain to include all objects.
Enter ou=VPN-Users,dc=COMPANY,dc=com to look up users under a specific organization unit.
Enable to specify the exchange server connector to collect information about authenticated users from a corporate exchange server. See Exchange Server connector for more details.
Select one of the following options:
- Simple: bind using simple password authentication using the client name. The LDAP server only looks up against the distinguished name (DN), but does not search on the subtree.
- Anonymous: bind using an anonymous user, and search starting from the DN and recurse over the subtrees. Many LDAP servers do not allow this.
- Regular: bind using the username and password provided, and search starting from the DN and recurse over the subtrees.
If using regular bind, enter a username with sufficient privileges to access the LDAP server. The following formats are supported:
If using regular bind, enter the password associated with the username.
Enable to apply security to the LDAP connection through STARTTLS or LDAPS.
If Secure Connection is enabled, select STARTTLS or LDAPS. Selecting STARTTLS changes the port to 389 and selecting LDAPS changes the port to 636.
Enable and select the certificate so the FortiGate will only accept a certificate from the LDAP server that is signed by this CA.
Server identity check
Enable to verify the server domain or IP address against the server certificate. This option is enabled by default and it is recommended to leave it enabled for a secure configuration.
When specifying a secure connection, there are some considerations for the certificate used by LDAP to secure the connection. The FortiGate checks the certificate presented by the LDAP server for the IP address or FQDN as specified in the Server IP/Name field with the following logic:
- If there is a Subject Alternative Name (SAN), it will ignore any Common Name (CN) value and look for a match in any of the SAN fields.
- If there is no SAN, it will check the CN for a match.
Optionally, click Test User Credentials to ensure that the account has sufficient access rights.
- Click OK.
The FortiGate checks the connection and updates the Connection Status.