LDAP servers
Lightweight Directory Access Protocol (LDAP) is an Internet protocol used to maintain authentication data that may include departments, people, groups of people, passwords, email addresses, and printers. LDAP consists of a datarepresentation scheme, a set of defined operations, and a request/response network.
If you have configured LDAP support and an administrator is required to authenticate using an LDAP server, the FortiAnalyzer unit sends the administrator’s credentials to the LDAP server for authentication. If the LDAP server can authenticate the administrator, they are successfully authenticated with the FortiAnalyzer unit. If the LDAP server cannot authenticate the administrator, the FortiAnalyzer unit refuses the connection.
To use an LDAP server to authenticate administrators, you must configure the server before configuring the administrator accounts that will use it.
To add an LDAP server:
- Go to System Settings > Admin > Remote Authentication Server.
- Select Create New > LDAP Server from the toolbar. The New LDAP Server pane opens.
- Configure the following settings, and then click OK to add the LDAP server.
| Name | Enter a name to identify the LDAP server. | |
| Server Name/IP | Enter the IP address or fully qualified domain name of the LDAP server. | |
| Port | Enter the port for LDAP traffic. The default port is 389. | |
| Common Name Identifier | The common name identifier for the LDAP server. Most LDAP servers use cn. However, some servers use other common name identifiers such as UID. | |
| Distinguished Name | The distinguished name is used to look up entries on the LDAP server.
The distinguished name reflects the hierarchy of LDAP database object classes above the common name identifier. Clicking the query distinguished name icon will query the LDAP server for the name and open the LDAP Distinguished Name Query window to display the results. |
|
| Bind Type | Select the type of binding for LDAP authentication: Simple, Anonymous, or Regular. | |
| User DN | When the Bind Type is set to Regular, enter the user DN. | |
| Password | When the Bind Type is set to Regular, enter the password. | |
| Secure Connection | Select to use a secure LDAP server connection for authentication. | |
| Protocol | When Secure Connection is enabled, select either LDAPS or STARTTLS. | |
| Certificate | When Secure Connection is enabled, select the certificate from the dropdown list. | |
| Administrative Domain | Choose the ADOMs that this server will be linked to for reporting: All ADOMs (default), or Specify for specific ADOMs. | |
| Advanced Options | ||
| adom-attr | Specify an attribute for the ADOM. | |
| attributes | Specify the attributes such as member, uniquemember, or memberuid. | |
| connect-timeout | Specify the connection timeout in millisecond. | |
| filter | Specify the filter in the format (objectclass=*) | |
| group | Specify the name of the LDAP group. | |
| memberof-attr | Specify the value for this attribute. This value must match the attribute of the group in LDAP Server. All users part of the LDAP group with the attribute matching the memberof-attr will inherit the administrative permissions specified for this group. | |
| profile-attr | Specify the attribute for this profile. | |
| secondary-server | Specify a secondary server. | |
| tertiary-server | Specify a tertiary server. | |
Sadly LDAP/Radius still remains a half-broken, fairly useless feature since as far as I know, they STILL do no proper Group Mapping, ala what a Fortigate has done for 10 years. You can LDAP filter on a specific group for exactly one group, but NOT if you need to have a Read-only Group, Admin Groups, etc at the same time. This is still frustrating to explain to customers why the FAZ sucks so much more than a fortigate, and you cannot set them up consistently.