Fortinet white logo
Fortinet docs logo DOCUMENT LIBRARY
Fortinet white logo
Fortinet docs logo DOCUMENT LIBRARY
Products Best Practices Hardware Guides Products A-Z
Summary
By Solution
By 4D Pillars
By Cloud
Secure Networking
Unified SASE
Security Operations
Secure SD-WAN
Secure Access Service Edge (SASE)
ZTNA
LAN Edge
Identity and Access Management
Next Generation Firewall
Public Cloud
Private Cloud
FortiCloud
Secure Networking
  • Hybrid Mesh Firewall
  • NOC Management
  • LAN
  • WAN
    • More >>
    Unified SASE
  • Single Vendor SASE
  • Cloud Network Security
  • Secure Endpoint Connectivity
  • Web Application / API Protection
    • More >>
    Security Operations
  • Security Operations Automation
  • Identity
  • Early Detection & Prevention
    • More >>
    Secure Networking
  • Hybrid Mesh Firewall
  • NOC Management
  • LAN
  • WAN
  • Communication & Surveillance
    • Unified SASE
  • Single Vendor SASE
  • Secure Endpoint Connectivity
  • Cloud Network Security
  • Cloud-Native Security
  • Web Application / API Protection
    • Security Operations
  • Security Operations Automation
  • Endpoint
  • Data Protection
  • Identity
  • Email
  • Early Detection & Prevention
  • Expert Services
  • Edge Firewall
  • Orchestration & management
  • SD Branch
  • Application Delivery
  • Single Vendor SASE
  • Secure Endpoint Connectivity
  • Secure Private Access
  • Thin Edge
  • Identity
  • Application Gateway
  • Enterprise Asset Management
  • Endpoint Agent
  • Agentless Security Posture
  • Identity
  • Wireless
  • Switching
  • Identity
  • Privilege Acccess Management
  • Next Generation Firewall
  • Orchestration & management
  • Expert Services
  • All
  • All
  • Account Management
  • SAAS Management
  • SAAS Application Security
  • Managed Services
  • Platform as a service (PAAS)
  • Other SAAS Services
    • 4D Resources
    Solution Hubs
  • 4D Pillars
  • Cloud
  • Popular Solutions

    • Administration Guide

    Home FortiWeb 6.3.9 Administration Guide
    6.3.9
    7.6.0
    7.4.5
    7.4.4
    7.4.3
    7.4.2
    7.4.1
    7.4.0
    7.2.10
    7.2.9
    7.2.8
    7.2.7
    7.2.6
    7.2.5
    7.2.4
    7.2.3
    7.2.2
    7.2.1
    7.2.0
    7.0.10
    7.0.9
    7.0.8
    7.0.6
    7.0.5
    7.0.4
    7.0.3
    7.0.2
    7.0.1
    7.0.0
    6.4.2
    6.4.1
    6.4.0
    6.3.23
    6.3.19
    6.3.18
    6.3.17
    6.3.16
    6.3.15
    6.3.14
    6.3.13
    6.3.11
    6.3.10
    6.3.9
    6.3.7
    6.3.6
    6.3.5
    6.3.4
    6.3.3
    6.3.2
    6.3.1
    6.3.0
    6.2.5
    6.2.4
    6.2.3
    6.2.2
    6.2.1
    6.2.0
    6.1.2
    6.1.1
    5.7.0
    5.6.1
    5.6.0
    5.6.0

    To create an Active Directory (AD) user for FortiWeb

    To create an Active Directory (AD) user for FortiWeb

    If your site publish rule uses Kerberos Constrained Delegation for authentication delegation, it requires the following values:

    • The SPN of an AD user that FortiWeb uses to obtain Kerberos tickets on behalf of clients.
    • The keytab file that corresponds to the AD user.
    1. Create an AD user.

      2. For example, create the user http-delegator.

    2. Generate a Service Principal Name (SPN) for the AD user. Enter the following command using the SetSPN utility and a Windows command prompt:

      3. setspn -A host/<service_name>.<domain> <login_domain>\<ad_user_name>


      where:

      <service_name> is the name of the service to register

      <domain> is the appropriate domain

      <login_domain> is the domain used with the logon name

      <ad_user_name> is the AD user name

      For example: setspn -A host/forti-delegator.dc1.com DC1\http-delegator

      You cannot access the delegation settings for a user until it has an SPN.

    3. In the properties for the AD user, on the Delegation tab, select Trust this user for delegation to specified services only, and then select Use any authentication protocol.

    4. Click Add, and then click Users or Computers to open the Select Users or Computers dialog box.
    5. For Enter the object names to select, enter the name of the computer where the web service resides.

      6. You can use the hostname command to retrieve the computer name.

    6. Click OK, and then, in the Add Services dialog box, under in the list of available services, select the http item.

    7. Click OK.

    8. Click OK to close the AD user properties.
    9. Use the Ktpass utility to extract a keytab file for the AD user.

      10. Ensure that you generate the keytab file using the SPN you generated for the AD user in Generate a Service Principal Name (SPN) for the AD user. Enter the following command using the SetSPN utility and a Windows command prompt: .

      For complete information about Ktpass, go to the following location:

      http://technet.microsoft.com/en-us/library/cc779157(v=ws.10).aspx

      Ktpass output the extracted keytab file to the directory of the current user.

      For example:

      C:\Users\Administrator\test.keytab

    10. To upload the keytab file, go to Application Delivery > Site Publish > Keytab File.
    11. Click Create New and enter a name to use for the file in the web UI.
    12. Click Choose File and then browse to the file to select it, and then click OK to complete the upload.
    Previous
    Next

    To create an Active Directory (AD) user for FortiWeb

    To create an Active Directory (AD) user for FortiWeb

    If your site publish rule uses Kerberos Constrained Delegation for authentication delegation, it requires the following values:

    • The SPN of an AD user that FortiWeb uses to obtain Kerberos tickets on behalf of clients.
    • The keytab file that corresponds to the AD user.
    1. Create an AD user.

      2. For example, create the user http-delegator.

    2. Generate a Service Principal Name (SPN) for the AD user. Enter the following command using the SetSPN utility and a Windows command prompt:

      3. setspn -A host/<service_name>.<domain> <login_domain>\<ad_user_name>


      where:

      <service_name> is the name of the service to register

      <domain> is the appropriate domain

      <login_domain> is the domain used with the logon name

      <ad_user_name> is the AD user name

      For example: setspn -A host/forti-delegator.dc1.com DC1\http-delegator

      You cannot access the delegation settings for a user until it has an SPN.

    3. In the properties for the AD user, on the Delegation tab, select Trust this user for delegation to specified services only, and then select Use any authentication protocol.

    4. Click Add, and then click Users or Computers to open the Select Users or Computers dialog box.
    5. For Enter the object names to select, enter the name of the computer where the web service resides.

      6. You can use the hostname command to retrieve the computer name.

    6. Click OK, and then, in the Add Services dialog box, under in the list of available services, select the http item.

    7. Click OK.

    8. Click OK to close the AD user properties.
    9. Use the Ktpass utility to extract a keytab file for the AD user.

      10. Ensure that you generate the keytab file using the SPN you generated for the AD user in Generate a Service Principal Name (SPN) for the AD user. Enter the following command using the SetSPN utility and a Windows command prompt: .

      For complete information about Ktpass, go to the following location:

      http://technet.microsoft.com/en-us/library/cc779157(v=ws.10).aspx

      Ktpass output the extracted keytab file to the directory of the current user.

      For example:

      C:\Users\Administrator\test.keytab

    10. To upload the keytab file, go to Application Delivery > Site Publish > Keytab File.
    11. Click Create New and enter a name to use for the file in the web UI.
    12. Click Choose File and then browse to the file to select it, and then click OK to complete the upload.
    Previous
    Next