Example 7: Secure authentication for LDAP user source via ZTNA server

When a customer LDAP or Active Directory (AD) resides on premises, FIC requires a secure connection to access it for user authentication. This connection is established through a FortiGate (FGT) acting as a ZTNA Tunnel Server which provides a TLS-encrypted path between FIC and the customer’s internal LDAP/AD server.

This section covers the following topics

• Secure communication path

• FortiGate configuration

• FortiIdentity Cloud configuration

• FortiGate as ZTNA server for LDAP user source

• Configuring ZTNA server in FortiGate

Secure communication path

FIC App > LDAP Client > ZTNA Proxy > FortiGate > LDAP Server

This setup provides a secure communication path that enables:

• Secure LDAP authentication via LDAPS (port 636), LDAP + StartTLS (port 389) or mTLS

• Certificate-based authentication for tunnel establishment

• Full encryption and policy control over the communication channel

FortiGate configuration

Step 1: Configuring the FortiGate as a ZTNA server.

1. Configure on an external interface, making sure that it can reach FortiIdentity Cloud.

2. Map the service on the public interface to forward TCP traffic on a required port (i.e., 389 or 636) to the internal LDAP server configured on the FortiGate.

Step 2: Configuring an authentication rule.

1. Apply the rule to the external interface.

2. Use certificate-based authentication for security.

3. Restrict access to FIC’s source WAN IPs only.

Step 3: Configuring a firewall policy.

1. Allow traffic from the FIC source IP to the ZTNA tunnel address.

2. Ensure that the policy includes the required security profiles, if applicable.

For more information, see Basic ZTNA configuration.

FortiIdentity Cloud configuration

1. Navigate to Authentication > Tunnel.

2. Create a ZTNA tunnel object.

3. Click Save.

Parameter	Description
Name	ZTNA tunnel name, e.g., ZTNA-LDAP-Tunnel
Server IP/FQDN	External/public-facing interface address of the FortiGate
Server Port	Port number configured on the ZTNA server.
Client Certificate	Public/private key pair used by FIC as tunnel client which the certificate uploads to the FIC portal under Settings.
Server CA Cert	Used to validate the FortiGate server certificate, e.g., Default.

Once configured, enable the ZTNA tunnel using the toggle button whenever LDAP traffic should be routed through the FortiGate.

FortiGate as ZTNA server for LDAP user source

When you logging into the FortiGate that is configured as the ZTNA server for LDAP authentication, it provides a TLS-encrypted connection between FIC and your internal LDAP/AD server.

For initial configuration of the FortiGate, ensure that it is able to reach the FIC’s WAN IP addresses for your region:

Region	IP addresses
North America	154.52.17.20 184.94.113.100
Europe	209.40.97.128 154.52.13.228

Once you've validated the connection, you can move on to configure the FortiGate as the ZTNA server.

Configuring ZTNA server in FortiGate

1. Log into the FortiGate.

2. Validate the FIC’s WAN IP access via the FortiGate Web CLI.

3. Upon successful validation, configure the LDAP server IP address in the FortiGate.

   FGVMULTM00000000 (root) # config firewall address 
   
   FGVMULTM00000000 (address) # edit ldap-access
   
   set uuid 6bb8c362-eb2d-51f0-8655-xxxxxxxxxxx
           set associated-interface "port1"
           set subnet 10.160.x.x 255.255.255.255
       next 
   end
   

4. Once the LDAP server is configured, configure the authentication scheme.

   FGVMULTM00000000 (root) # config authentication scheme 
   
   FGVMULTM00000000 (scheme) # show
   config authentication scheme
       edit "ztna-101"
           set method cert
           set user-cert enable
       next
   end
   

5. Configure the authentication rule.

   FGVMULTM00000000 (root) # config authentication rule 
   
   FGVMULTM00000000 (rule) # show
   config authentication rule
      edit "ztna-101"
        	set srcintf "port1"
          set srcaddr "all"
      set ip-based disable
      set active-auth-method "ztna-101"
       	next
   end
   

6. Configure the authentication setting.

   FGVMULTM00000000 (setting) # show
   config authentication setting
      set update-time 2025-10-01 14:33:09
      set user-cert-ca "Fortinet_Sub_CA"
   end
   

7. Configure the user certificate.

   FGVMULTM00000000 (root) # config user certificate 
   
   FGVMULTM00000000 (certificate) # show
   config user certificate
       edit "ztna-101-ldapuser"
           set type single-certificate
           set common-name "fic.fortinet.com"
       next
   end
   

8. Configure the firewall VIP.

   FGVMULTM00000000 (root) # config firewall vip 
   
   FGVMULTM00000000 (vip) # show
   config firewall vip
       edit "ztna-test"
           set uuid c8d7756c-9ee7-51f0-997b-xxxxxxxxxxxx
           set type access-proxy
           set server-type https
           set extip 10.160.xx.xxx
           set extintf "port1"
           set extport 8443
           set ssl-certificate "Fortinet_Factory"
       next
   end
   

9. Configure the firewall access-proxy.

   FGVMULTM00000000 (root) # config firewall access-proxy 
   
   FGVMULTM00000000 (access-proxy) # show
   config firewall access-proxy
       edit "ztna-test"
           set vip "ztna-test"
           config api-gateway
               edit 2
                   set url-map "/tcp"
                   set service tcp-forwarding
                   config realservers
                       edit 1
                           set address "ldap-access"
                           set mappedport 389 
                       next
                   end
               next
           end
       next
   end
   

10. Configure the firewall proxy-policy.

    FGVMULTM00000000 (root) # config firewall proxy-policy 
    
    FGVMULTM00000000 (proxy-policy) # show
    config firewall proxy-policy
        edit 1
            set uuid d33d9df4-9f07-51f0-5a9d-xxxxxxxxxxxx
            set proxy access-proxy
            set access-proxy "ztna-test"
            set srcintf "port1"
            set srcaddr "all"
            set dstaddr "all"
            set action accept
            set schedule "always"
            set users "ztna-101-ldapuser"
        next
    end
    

11. After the ZTNA server configuration in FortiGate is completed, log into the FIC portal and navigate to Authentication > Tunnel. Configure the ZTNA tunnel on the portal with the FortiGate ZTNA Server's IP/FQDN, Server Port, Client Certificate, and Server CA Cert.

    

12. Once the ZTNA tunnel is configured, validate the LDAP server access via the ZTNA server by providing the LDAP server IP & port (i.e., 389 or 636).

    

13. Now add the LDAP users to the FIC portal by navigating to User Management > Users >Batch Add.

14. Manually enter the user information that is configured in the LDAP user source, or use the Import tool to import all the users to the FIC portal.

    

    For more information, see Onboarding users.

Once the users are added/imported into FIC, they can log into any SSO applications (such as End-user portal and FortiProducts) that the FIC admin has configured in the system.