Single Sign-On using LDAP and FSSO agent in advanced mode (Expert)

Facebooktwittergoogle_plusredditpinterestlinkedinFacebooktwittergoogle_plusredditpinterestlinkedin

This recipe illustrates FortiGate user authentication with FSSO and a Windows DC LDAP server. In this example, user authentication controls Internet access.

1. Integrating the FortiGate with the Windows DC LDAP server

Go to User & Device > LDAP Servers to configure the LDAP server.

2. Installing FSSO agent on the Windows DC server

Accept the license and follow the Wizard.

Enter the Windows AD administrator password.

 CA step1

Select the Advanced Access method.

 CA step2

In the Collector Agent IP address field, enter the IP address of the Windows AD server.

 CA step3
Select the domain you wish to monitor.  CA step4
Next, select the users you do not wish to monitor.  CA step5
Under Working Mode, select DC Agent Mode.  CA step6
Reboot the Domain Controller.  CA step7

Upon reboot, the collector agent will start up.

You can choose to Require authenticated connection from FortiGate and set a Password.

 CA step8

3. Configuring Single Sign-On on the FortiGate

Go to User & Device > Single Sign-On and create a new SSO server.

Under the Groups tab, select the user groups to be monitored. In this example, the “FortiOS Writers” group is used.

4. Adding a user group to the FortiGate

Go to User & Device > User Groups to create a new FSSO user group.

Under Members, select the “FortiOS Writers” group.

5. Adding a policy to the FortiGate

Go to Policy & Objects > IPv4 Policy and create a policy allowing  “FortiOS_Writers” to navigate the Internet with appropriate security profiles.

The default Web Filter security profile is used in this example.

9. Results

Have users log on to the domain, go to the FSSO agent, and select Show Logon Users.
From the FortiGate, go to Dashboard to look for the CLI Console widget and type this command for more detail about current FSSO logons:

diagnose debug authd fsso list

----FSSO logons----
IP: 10.10.20.3  User: ADMINISTRATOR  Groups: CN=FORTIOS WRITERS,CN=USERS,DC=TECHDOC,DC=LOCAL  Workstation: WIN2K8R2.TECHDOC.LOCAL MemberOf: FortiOS_Writers
IP: 10.10.20.7  User: TELBAR  Groups: CN=FORTIOS WRITERS,CN=USERS,DC=TECHDOC,DC=LOCAL  Workstation: TELBAR-PC7.TECHDOC.LOCAL MemberOf: FortiOS_Writers
Total number of logons listed: 2, filtered: 0
----end of FSSO logons----

From the FortiGate, go to Monitor > Firewall User Monitor and verify FSSO Logons.

Have users go to the Internet and the security profiles will be applied accordingly.

Go to Log & Report > Forward Traffic to verify the log. 

Select an entry for details.

 

Taher Elbar

Taher Elbar

Technical Product Specialist at Fortinet
After a Bachelor degree in Telecommunications from university of Geneva, Taher began his career in software development, then moved to System/Network administration followed by Security Support Engineer. With over 10 years of experience, Taher is writing various Technical documentation for Fortinet.
Taher Elbar
  • Was this helpful?
  • Yes   No
  • Muthu

    Dear Taher ,

    I have combination of computers with domain users and workgroup users who is not in part of our domain controller .

    How to allow internet for those users without FSSO.

    • Taher Elbar

      Hi Muthu,
      If they have the same internet access privileges, then add them to the same policy as different user group. If not create another policy just for them.

      Regards,
      Taher.

  • Cesar G

    Taher, how can I make a backup of FSSO in advanced mode? I mean, I have 2 LDAP servers where I installed the 2 FSSO agents. Regards

    • Taher Elbar

      Hi Cesar,
      Do you mean backup the users from FSSO or backup the system including FSSO configuration ?
      Ca you tell me what are you trying to achieve?
      Regards,
      Taher.

      • Cesar G

        Hi Taher, I mean two ldap servers, I didn´t know how to configure two ldap servers. On CLI, but the issue was solved.
        Regards