Helpful ReplyHot!SSO and LDAP Configuration for Office365-only organization

Author
Marzigliano
New Member
  • Total Posts : 1
  • Scores: 2
  • Reward points: 0
  • Joined: 2016/12/30 15:27:26
  • Status: offline
2017/01/12 09:36:46 (permalink) 5.4
5 (1)

SSO and LDAP Configuration for Office365-only organization

We're configuring our first/new FortiGate device and need to connect in users on the LDAP/RADIUS and SSO pages. There is no local server, AD, or domain controller presence in the organization, as they exclusively use Office 365, so we are trying to configure the FortiGate to connect to Office 365 or Azure for the LDAP/RADIUS and SSO configuration. We've been scouring the documentation/help at Fortinet and at Microsoft but to no avail.  We will face a similar challenge next week with an org that has only G-Suite users and no local servers either.
#1
afleming
New Member
  • Total Posts : 3
  • Scores: 0
  • Reward points: 0
  • Joined: 2017/01/12 11:29:09
  • Status: offline
Re: SSO and LDAP Configuration for Office365-only organization 2017/01/13 07:52:14 (permalink)
0
I don't know about O365, but this link might be helpful for SSO for G-Suite users.  Make G-Suite a SAML IDP and the FortiGate a SAML SP?  
 
https://support.google.com/a/answer/6087519?hl=en
 
 
#2
ttreat
New Member
  • Total Posts : 5
  • Scores: 0
  • Reward points: 0
  • Status: offline
Re: SSO and LDAP Configuration for Office365-only organization 2017/01/30 11:32:51 (permalink)
0
I have been looking into doing this same thing. From researching online and also talking to specialists at Microsoft in their IDP/SSO department, I have not really found an easy way to do this. It seemed at first there was going to be some options for using Microsoft MFA server to act as a RADIUS server, but the more I looked into it we realized it would not work. If you look at this link ( https://docs.microsoft.com/en-us/azure/multi-factor-authentication/multi-factor-authentication-get-started ) you will see that using MFA server for authenticating users for things like VPN and WiFi, one would need a local on-site MFA server - but to authenticate/authorize cloud Office365 users one would have to use the cloud MFA server...so kind of a catch-22. 
 
The only thing I think would work is to enable full cloud Azure ADFS and open a VPN tunnel to the cloud ADFS for the Fortinet to use for IDP/SSO, or to use a 3rd party group like jumpcloud. 
 
I hope to hear Microsoft gets this going in some way, but I'm sure they are trying to not go so fast as to abandon their on-site AD base which I'm sure still brings a lot of money. 
#3
nicol.azevedo
New Member
  • Total Posts : 1
  • Scores: 0
  • Reward points: 0
  • Joined: 2018/08/29 10:15:22
  • Status: offline
Re: SSO and LDAP Configuration for Office365-only organization 2018/08/29 10:28:59 (permalink)
0
Hi Marzigliano,
 
Did you manage to achieve  your goal? Because I need the exact same configuration butt can't find a way to do it.
 
Appreciate your help.
 
Regards,
 
 
#4
morleyc
New Member
  • Total Posts : 4
  • Scores: 0
  • Reward points: 0
  • Joined: 2018/02/09 23:29:59
  • Status: offline
Re: SSO and LDAP Configuration for Office365-only organization 2018/12/22 01:44:51 (permalink)
0
Me three, exact same requirement, please let me know if anyone has found a solution?
#5
v20100
Bronze Member
  • Total Posts : 35
  • Scores: 2
  • Reward points: 0
  • Joined: 2016/09/07 22:28:14
  • Status: offline
Re: SSO and LDAP Configuration for Office365-only organization 2019/01/28 20:10:53 (permalink)
0
I have been able to authenticate against AzureAD. You need to install the Domain Services and then setup LDAPS.
It works fine, but there was some tricks to configure the ldap server on the Fortigate. I can share the details if you are interested.
Note that I have not found a solution for using existing AzureAD MFA or a free or cheap MFA solution for Forticlient that works with LDAPS on AzureAD.
 
At this stage, I believe the only way is to put FortiAuthenticator in the mix, but it comes with extra cost.
 
I will test this in the next few days as a POC
#6
hu_FTNT
New Member
  • Total Posts : 1
  • Scores: 0
  • Reward points: 0
  • Joined: 2019/02/12 18:20:31
  • Status: offline
Re: SSO and LDAP Configuration for Office365-only organization 2019/02/12 18:23:30 (permalink)
0
v20100,
Can you share the details?
#7
v20100
Bronze Member
  • Total Posts : 35
  • Scores: 2
  • Reward points: 0
  • Joined: 2016/09/07 22:28:14
  • Status: offline
Re: SSO and LDAP Configuration for Office365-only organization 2019/02/12 20:38:28 (permalink) ☄ Helpfulby hu 2019/02/18 20:13:10
5 (1)
We are assuming that Domain Services and LDAPS is properly configured in Azure
On FG, for ldap server, make sure you use port 636
Common Name Identifier: sAMAccountName
Use your DN
Bind type: Regular
Username: use company\username syntax.
If you use username or [link=mailto:username@companydomainname]username@companydomainname[/link] it does not work
Secure Connection: selected
Protocol LDAPS
No certificate
 
Check that the connection is successful and if you are on version 6, test a user credential from there.
No point to carry on, if you connection is not successful
 
When you create your User group, use the previously created LDAP server.
If like me, you want to restrict access to a particular user group, on your Recursive list, select OU=AADDC Users, and search for your required group. Once found, you need to right click on it to select it.
 
The next step is the one which tricked me for a couple of days: 
When you try Forticlient, it fails to authenticate. Error message is not helping  and there is nothing in the logs of interest. Of course, there is nothing either on AzureAD
The change to make it work is as follow on the FG:
config system global
set ldapconntimeout 5000
end
 
Also, on the Forticlient, username is shortname of UPN. If user uses full UPN it will fail. You can see these attempts in the logs
 
Good luck
#8
dcook
New Member
  • Total Posts : 1
  • Scores: 2
  • Reward points: 0
  • Joined: 2019/02/15 16:27:26
  • Status: offline
Re: SSO and LDAP Configuration for Office365-only organization 2019/02/15 16:52:01 (permalink) ☄ Helpfulby hu 2019/02/18 20:13:06
5 (1)
I just went through figuring this out today with some trial and error.   Here is what worked for my setup.
 
I'm on  FortiOS v6.0.4 build0231 (GA)

This is for Azure AD with no local domain sync enabled.  Make sure domain services is set up and ldaps is configured with a proper certificate.  
Also don't forget to set AADS NSG rules to allow ldaps on port 636 from your firewall IP.

Edit the global settings for a longer ldap connection timeout to 5000
config system global
set ldapconntimeout 5000

Set up a LDAP server
Name    AzureAD
Server IP/Name    your.ldap.name
Server Port    636
Common Name Identifier    userPrincipalName
Distinguished Name    ou=AADDC Users,dc=company,dc=com
Bind Type    Regular
Username   &nbsp bind@company.com   (The bind account needs to be in the AAD DC Administrators group)
Password    userpassword
Secure Connection checked to on
Protocol ldaps
Certificate    none

Test Connectivty and then Test User Credentials.
The username is their primary email address.   test@company.com  If you have Office 365 MFA enabled it will fail. I haven't found anyway to auth a user successfully with MFA enabled.

Go to User Groups and do not create a new user group.  Select local and add a Remote Group.  Add the ldap server from above as the Remote Server.
Select the ldap group the vpn user are in.  Make sure you right click on the grou and hit + Add Selected.

In SSL-VPN Settings under Authentication/Portal Mapping add the local group to the Portal full-access if your users are going to have full tunnel access.




post edited by dcook - 2019/02/15 16:57:08
#9
v20100
Bronze Member
  • Total Posts : 35
  • Scores: 2
  • Reward points: 0
  • Joined: 2016/09/07 22:28:14
  • Status: offline
Re: SSO and LDAP Configuration for Office365-only organization 2019/02/18 20:29:11 (permalink)
0
Hi dcook,
 
it is good to know there are several ways (ie using shortname or full upn)
I am surprised it does not work if your users have Office 365 MFA enabled.
In our case, we have Azure MFA for all , and it does not seem to affect their login via ldap or require MFA (in fact I would have loved if they had been prompted for their Azure MFA SSO!)
 
Ultimately, we want to use 2FA with Forticlient but it does not look like we can use MFA from Azure for this
Looks like the only solution is to use FortiAuthenticator, to authenticate against Azure Ldap, and then provide 2FA via Radius to the Fortigate.
I tested successfully with a local user on FortiAuthenticator, but am waiting for Fortinet to fix the bug to authenticate with Azure Ldap or Gsuite to carry on testing the full solution
 
Cheers
#10
Jump to:
© 2019 APG vNext Commercial Version 5.5