Configuring LDAP dial-in using a member attribute

In this configuration, users defined in Microsoft AD can set up a VPN connection based on an attribute that is set to TRUE, instead of their user group. You can activate the Allow Dialin property in AD user properties, which sets the msNPAllowDialin attribute to TRUE. You can use this procedure for other member attributes as your system requires.

This configuration consists of the following steps:

1. Ensure that the AD server has the msNPAllowDialin attribute set to TRUE for the desired users.

2. Configure user LDAP member attribute settings.

3. Configure LDAP group settings.

4. Ensure that you configured the settings correctly.

To configure user LDAP member attribute settings:

config user ldap
    edit "ldap_server"
        set server "192.168.201.3"
        set cnid "sAMAccountName"
        set dn "DC=fortilabanz,DC=com,DC=au"
        set type regular
        set username "fortigate@sample.com"
        set password ******
        set member-attr "msNPAllowDialin"
    next
end

To configure LDAP group settings:

config user group
    edit "ldap_grp"
        set member "ldap_server"
        config match
            edit 1
                set server-name "ldap_server"
                set group-name "TRUE"
            next
        end
    next
end

To ensure that you configured the settings correctly:

Users that are members of the ldap_grp user group should be able to authenticate. The following shows sample diagnose debug output when the Allow Dial-in attribute is set to TRUE:

get_member_of_groups-Get the memberOf groups.
get_member_of_groups- attr='msNPAllowDialin', found 1 values
get_member_of_groups-val[0]='TRUE'
fnbamd_ldap_get_result-Auth accepted
fnbamd_ldap_get_result-Going to DONE state res=0
fnbamd_auth_poll_ldap-Result for ldap svr 192.168.201.3 is SUCCESS
fnbamd_auth_poll_ldap-Passed group matching

If the attribute is not set to TRUE but is expected, you may see the following output:

get_member_of_groups-Get the memberOf groups.
get_member_of_groups- attr='msNPAllowDialin', found 1 values
get_member_of_groups-val[0]='FALSE'
fnbamd_ldap_get_result-Auth accepted
fnbamd_ldap_get_result-Going to DONE state res=0
fnbamd_auth_poll_ldap-Result for ldap svr 192.168.201.3 is SUCCESS
fnbamd_auth_poll_ldap-Failed group matching

The difference between the two outputs is the last line, which shows passed or failed depending on whether the member attribute is set to the expected value.