Configuring certificate bindings

To use a local certificate as part of authenticating a user, you need to:

l Create a user certificate for the user, see To create a new certificate: on page 134. l Create a binding to that certificate in the user’s account.

To create a binding to a certificate in a user’s account:

1. Go to the Change user window for the requisite user account.
2. Expand the Certificate Bindings
3. Select Add Binding. The Create New Local UserCertificate Binding window opens.
4. Select either Local CA or Trusted CA and then select the applicable CA certificate from the drop-down list.
5. Enter the Common Name on the certificate. For example, if the certificate says CN=rgreen then enter rgreen.
6. Select OK to add the new binding.

Remote users

Remote LDAP users must be imported into the FortiAuthenticator user database from LDAP servers, see LDAP on page 88. A maximum of five users can be imported.

Remote RADIUS users can be created, migrated to LDAP users, edited, and deleted.

LDAP users

To import remote LDAP users:

1. Go to Authentication > UserManagement > Remote Users, ensure that LDAP users is selected, then select Import. The Import Remote LDAP Users screen open.
2. Select a remote LDAP server from the Remote LDAP Server drop-down list, then select Import Users.

The Import Remote LDAP Users window opens in a new browser window.

3. Optionally, enter a Filter string to reduce the number of entries returned, and then select Apply, or select Clear to clear the filters.
4. The default configuration imports the attributes commonly associated with Microsoft Active Directory LDAP implementations. Select Configure userattributes to edit the remote LDAP user mapping attributes. Selecting the field, FirstName for example, presents a list of attributes which have been detected and can be selected. This list is not exhaustive and additional, non-displayed attributes may be available for import.

Consult your LDAP administrator for a list of available attributes.

5. Select the entries you want to import.
6. Optionally, select an organization from the Organization drop-down to associated the imported users with a specific organization. See Organizations on page 70.
7. Select OK.

The amount of time required to import the remote users will vary depending on the number of users being imported.

To add two-factor authentication to a remote LDAP user:

1. From the remote user list, select the user you are editing. The Edit Remote LDAP User window opens.
2. Select Token-based authentication, then follow the same steps as when editing a local user (Editing a user on page 60).
3. Configure the UserRole, UserInformation, Radius Attributes, and Certificate Bindings for the user as needed.
4. Select OK to apply the changes.

RADIUS users

To view remote RADIUS users, go to Authentication > UserManagement > Remote Users and select RADIUS users in the toolbar. See RADIUS on page 91 for more information about remote RADIUS servers.

The following options are available:

Create New	Select to create a new remote RADIUS user.
Delete	Select to delete the selected user or users.
Edit	Select to edit the selected user.
Migrate	Select to migrate the selected user or users. See To migrate RADIUS users to LDAP users: on page 68.
Token-based Auth	Select to enforce or bypass token-based authentication for the selected user or users.
Search	Search the remote RADIUS user list.
Username	The remote user’s name.
Remote RADIUS server	The remote RADIUS server or which the user resides.
Token	The FortiToken used by the user, if applicable.
Enforce token-based authentication	Whether or not token-based authentication is enforced.

To create a new remote RADIUS user:

1. From the remote user list, select RADIUS users, then select Create New. The Create New Remote RADIUS User window opens.
2. Enter the following information:

Remote RADIUS	Select the remote RADIUS server on which the user will be created from the drop-down list. For more information on remote RADIUS servers, see RADIUS on page 91.
Username	Enter a username.
Enforce          token-   based authentication if configured below	Select to enforce the token-based authentication, if you are configuring token-based authentication.
Token-based authentication	Select to configure token-based authentication.
Deliver token code by	Select the method by which token code will be delivered. One of: l  FortiToken: select the FortiToken device serial number from the FortiToken 200 or FortiToken Mobile drop-down lists, as appropriate. 1.     The device must be known to the FortiAuthenticator unit. See FortiToken devices and mobile apps on page 72. 2.     Optionally, select Configure a temporary e-mail/SMS token to receive a temporary token code via email or SMS. l  Email: enter the user’s email address in the UserInformation section. l  SMS: enter the user’s mobile number in the UserInformation section.
User Information	Enter user information as needed. The following options are available: l  Email address l  Mobile number and SMS gateway l Language l Organization – see Organizations on page 70.

3. Select OK to create the new remote RADIUS user.

To migrate RADIUS users to LDAP users:

1. From the remote RADIUS users list (see Learned RADIUS users on page 131), select the user or users you need to migrate, then select Migrate from the toolbar. The Migrate RADIUS Users to LDAP Users window opens.
2. Select a LDAP server from the drop down list to which the selected RADIUS user or users will be located, then select Next.
3. Enter the distinguished names for the users that are being migrated, or browse the LDAP tree (see Directory tree overview on page 95) to find the users.
4. Select Migrate to migrate the user or users.

Remote user sync rules

Synchronization rules can be created to control how and when remote users are synchronized. To view a list of the remote user synchronization rules, go to Authentication > User Management > Remote UserSync Rules.

 

To create a new remote user synchronization rule:

1. From the Remote UserSync Rules page, select Create New. The Create New Remote UserSynchronization Rule windows opens.
2. Configure the following settings:

Name	Enter a name for the synchronization rule.
Remote LDAP	Select a remote LDAP server from the drop-down list. To configure a remote LDAP server, see Remote authentication servers on page 88.
Sync every	Select the amount of time between synchronizations.
LDAP filter	Optionally, enter an LDAP filter. Select Test Filter to test that the filter functions as expected.
Token-based authentication sync priorities	Select the required authentication synchronization priorities. Drag the priorities up and down in the list change the priority order.
Sync as	Select to synchronize as a remote user or as a local user. Selecting either option will open a pop-up dialog box displaying the user fields that will be synchronized for that selection.
Group to associate users with	Optionally, select a group from the drop-down list with which to associate the users with, or select Create New to create a new user group. See User groups on page 69.
Organization	Optionally, select an organization from the drop-down list with which to associate the users with, or select Create New to create a new organization. See Organizations on page 70.
LDAP User Mapping Attributes	Optionally, edit the remote LDAP user mapping attributes.
Preview Mapping	Select to preview the LDAP user sync mappings in a new window.
Show Sync Fields	Select to view the user fields that will be synchronized.

3. Select OK to create the new synchronization rule.