Hot!Kerberos Authentication Configuration

Author
KhizerSaleem
New Member
  • Total Posts : 14
  • Scores: 0
  • Reward points: 0
  • Joined: 2018/05/31 00:47:07
  • Status: offline
2018/05/31 01:24:58 (permalink)
0

Kerberos Authentication Configuration

Hi All,
 
I need the authentication while using explicit-web-proxy.
 
The matter of fact is that obviously, it needs Kerberos authentication for authentication of AD-Users but in the documents on the given link below, by Fortinet, it didn't give us the picture clearly. I read the authentication document in which it defines all Kerberos authentication process. 
 
http://help.fortinet.com/...it%20proxy%20users.htm
 
 Can I configure the FortiOS 5.6.x authentication settings on FortiOS 6.0, as I'm using this on Fortigate-VM 64 on evaluation period, or I need to set up the only Kerberos environment?
 
I want to know that is there any good guide or any video that can show us how to configure the process or do you have any kind of notes regarding this. 
 
Hope to see your kind reply soon.
 
Thnks in advance.
 
Best Regards
Khizer Saleem
#1

14 Replies Related Threads

    xsilver
    Expert Member
    • Total Posts : 502
    • Scores: 129
    • Reward points: 0
    • Joined: 2015/02/02 03:22:58
    • Location: EMEA
    • Status: offline
    Re: Kerberos Authentication Configuration 2018/05/31 04:57:18 (permalink)
    0
    Hi,
    mentioned help doc is quite complex and should cover most of the usual configuration variants.
    Basically said you have to decide between explicit/transparent proxy and ip-based/session-based authentication.
    And then follow the steps for one of those four basic config variants.
    Config is supposed to be same or very similar (not aware of any deviation) between 5.6 and 6.0 FortiOS.
    You need those parts .
    - LDAP server and group
    - KRB keytab
    - policy
    - config authentication parts defining schedules/rules etc.
     
    Kind regards,
    Tomas

    Kind Regards,
    Tomas
    #2
    KhizerSaleem
    New Member
    • Total Posts : 14
    • Scores: 0
    • Reward points: 0
    • Joined: 2018/05/31 00:47:07
    • Status: offline
    Re: Kerberos Authentication Configuration 2018/05/31 23:11:00 (permalink)
    0
    Hi,
     
    Well, thanks Tomas for your kind reply, yes the document is too complex neither Fortinet made any video on their video library, so its too complex I tried all the things but don't know which thing is missing.
     
    Thanks for your reply.
     
    Best Regards
    Khizer Saleem
     
    #3
    FortiBoris_FTNT
    New Member
    • Total Posts : 14
    • Scores: 0
    • Reward points: 0
    • Joined: 2016/09/20 01:16:45
    • Status: offline
    Re: Kerberos Authentication Configuration 2019/02/22 23:31:23 (permalink)
    0
    Hey all,

    Doing some Kereros + Explicit Proxy testings on v6.0.4.

    Simple question, how is a user mapped towards multiple AD groups?? For the moment it seems i'm mapped to the 1st group alphabetically and not multiple groups.

    The idea would be multiple AD groups mapped to different Explicit Proxy rules each having different Web Filtering profiles applied. Although, we would want to have the possibility to map users within multiple groups, hence mapped to different Web Filtering profile (Social_Surfers, Sports_Surfers, Hacking_Surfers etc...). You add Bob within Social_Surfers group @AD and it dynamically can surf Social Networks on the fly while keeping it's previous surfing "rights" from say Sports_Surfers where he also belongs.
     
    That scheme is possible with FSSO but couldn't reach my goal with Kerberos. User seems mapped to only ONE group while being members of more than one.
     
    Thanks,
    Boris
    post edited by FortiBoris_FTNT - 2019/02/22 23:34:48
    #4
    KhizerSaleem
    New Member
    • Total Posts : 14
    • Scores: 0
    • Reward points: 0
    • Joined: 2018/05/31 00:47:07
    • Status: offline
    Re: Kerberos Authentication Configuration 2019/02/23 01:09:23 (permalink)
    0
    Hi Boris,
     
    You just have to make that users part of multiple AD-Groups, and then map that AD Groups in FSSO agent under Fabric Connector tab, and then map that FSSO objects in the groups.
    After making groups, you can call them in multiple rules.
     
    I used the proxy setup on 6.0.3 but with NTLM method(session-based) and it was more secure and feasible.
     
    Regards
    Khizer Saleem
    #5
    FortiBoris_FTNT
    New Member
    • Total Posts : 14
    • Scores: 0
    • Reward points: 0
    • Joined: 2016/09/20 01:16:45
    • Status: offline
    Re: Kerberos Authentication Configuration 2019/02/23 04:38:44 (permalink)
    0
    Hey there Khizer,

    thanks for the update.. yes i saw that this is working with FSSO but wanted to achieve the same with Kerberos.. the FSSO polling agent at the FortiGate isn't supposed to scale at more than 200 users i think. hence the need for Kerberos..

    cheers,
    boris
    #6
    KhizerSaleem
    New Member
    • Total Posts : 14
    • Scores: 0
    • Reward points: 0
    • Joined: 2018/05/31 00:47:07
    • Status: offline
    Re: Kerberos Authentication Configuration 2019/02/23 08:08:27 (permalink)
    0
    Hi Boris,
     
    No no, you are not clear on it. You can add 1000+ AD groups per single FSSO Object, and it's confirmed.
    I consult the Fortinet TAC engineer while doing my project of the explicit web proxy. Unfortunately, I lost that table in which exact numbers were given, but I',m 100% sure it's feasible and secure too. 
     
     
    Regards
    Khizer Saleem
     
    #7
    KhizerSaleem
    New Member
    • Total Posts : 14
    • Scores: 0
    • Reward points: 0
    • Joined: 2018/05/31 00:47:07
    • Status: offline
    Re: Kerberos Authentication Configuration 2019/02/23 08:18:05 (permalink)
    0
    Hi Boris
     
    Forgot to mention that, always use the FSSO agent installed on Domain controller in the big AD environment.
     
    For more assistance, you can contact me on my personal email, khizersaleem1992@gmail.com
     
    Regards
    Khizer Saleem
     
     
    #8
    KhizerSaleem
    New Member
    • Total Posts : 14
    • Scores: 0
    • Reward points: 0
    • Joined: 2018/05/31 00:47:07
    • Status: offline
    Re: Kerberos Authentication Configuration 2019/02/23 08:24:21 (permalink)
    0
    Hi Boris
     
    You are lucky, after searching for more than an hour, I finally got the table. Here is the link for your consideration.
     
    https://help.fortinet.com/fgt/54/max-values/5-4-3/max-values.html
     
    You can find the detail of AD Groups and FSSO Servers too.
     
    Best Regards
    Khizer Saleem
     
    #9
    FortiBoris_FTNT
    New Member
    • Total Posts : 14
    • Scores: 0
    • Reward points: 0
    • Joined: 2016/09/20 01:16:45
    • Status: offline
    Re: Kerberos Authentication Configuration 2019/03/09 09:24:10 (permalink)
    0
    Hi,
     
    Just for the feedback, this works perfectly with Kerberos and user is seen with "every" AD groups he's belonging in. You can check the user group mapping seen at FGT with those CLIs:
     
    # diag debug enable
    # diag test app wad 2200 // 22xx (xx=process number)
    # diag test app wad 110


    [1]     user:bob@FPOC.LAN@1.1.1.1(0x7f8d9089d1a0), type:SES, vf:0, ref:211, ntlm:0, has_fsae:0, guest:0
                    user:1(0x7f8d912445a8), ip:1(0x7f8d913ad568), scheme=3, auth=yes, tfa=no, timeout:alive, id:1
                    time: create=39(near=1) access=16 auth=101 traffic=1
                    out_ip=0.0.0.0 out_ipv6=:: ftp_out_ip=0.0.0.0
                    concurrent user limit: 65536 lifetime=39s, creation time:Mon Feb 25 12:04:52 2019

        membership_type=1 number=2 srv/is_ldap=WIN-DC-LDAP/1:
        [member 1 len=46]: cn=surfers_hackers,cn=users,dc=fpoc,dc=lan
        [member 2 len=43]: cn=domain users,cn=users,dc=fpoc,dc=lan


    Hence crafting explicit proxy rules toward different users groups works all fine.
     
    Thanks
    Boris
    post edited by FortiBoris_FTNT - 2019/03/09 09:26:33
    #10
    slashdes
    New Member
    • Total Posts : 3
    • Scores: 0
    • Reward points: 0
    • Joined: 2017/11/09 05:39:06
    • Status: offline
    Re: Kerberos Authentication Configuration 2019/04/10 09:34:00 (permalink)
    0
    Hi! I have 2 ADs, and configured for kerberos auth fortigate 200e on it. It's works. But I have the issue, in some app. I have response for ntlm auth., but internet works on PC. I type the creds of my AD user, and see log on fortigate-ntlm auth failed ,user NA. Somebody have any ideas
    #11
    xsilver
    Expert Member
    • Total Posts : 502
    • Scores: 129
    • Reward points: 0
    • Joined: 2015/02/02 03:22:58
    • Location: EMEA
    • Status: offline
    Re: Kerberos Authentication Configuration 2019/04/10 23:14:55 (permalink)
    5 (1)
    Hi,
    I might have few ideas .. 
     
    1. log in from browser first as most of the custom apps are politely said network hostile and do not handle even basic networking like port usage and releases properly. And authentication ... muhehe. MOst app don't do NTLM.
     
    2. on FGT .. how about some basic networking / auth troubleshooting?
    diag debug app fnbamd 7
    diag debug auth -1
    diag sniff pack any 'host <DC-IP> and port 88 or 389' 6 0 a   ... or GUI packet capture towards DC

    Kerberos should communicate on udp port 88 and DC LDAP by default on port 389. So check if you got ticket granted.
    If your tokens are short and starts with T1R then those are NTLM (as 'negotiate' Auth method offer client ability to choose between NTLM and Kerberos token).
     
     
    3. on workstation you can check if you do have a key via cmd: klist
    or sniff via Wireshark as well.
     
    Config examples on: 
    http://help.fortinet.com/...it%20proxy%20users.htm
     

    Kind Regards,
    Tomas
    #12
    learningall555555
    New Member
    • Total Posts : 3
    • Scores: 0
    • Reward points: 0
    • Joined: 2020/01/29 03:25:27
    • Status: offline
    Re: Kerberos Authentication Configuration 2020/02/14 08:28:20 (permalink)
    0
    Hi, 
    i hope that you can give me advice where to look further. 
    I tried to configure explicit-proxy with kerberos authentication.
    By cookbook only "problematic step" was to convert  keytab to base64 and paste in cli. 
    After that I got an option to import keytab from file or paste direct to  FG web.
    I tried all options to eliminate problems with possible copy paste error. 
    Everything is setup by the official  cookbook, but i still can't authenticate with enabled authentication.
     
    Browser return clasicall error : The proxy server is refusing connections 
    Client have ticket, and in wireshark and browser i can see Negotiate field with:
    Proxy-Authorization: Negotiate YII.........
     
    When i connect to fortigate web interface, in wireshark and in FG capture and in debug I can see ldap messages (udp 389) between FG and ldap.
     
    But when testing with enabled proxy in browser, i don't see ldap or kerberos packet between fortigate and AD/ldap. 
    During page refresh with  enabled debug settings: 
    -diagnose wad debug enable category auth;
    -diagnose debug enable;
     
     
    I got from debug logs: 
    [25327] wad_auth_rule_match(892): match auth rule succ: Auth-Rule
    [25327] wad_http_request_get_user(25981): process=25327 auth-rule=Auth-Rule user=/0/0 ip-based/auth-cookie/transact=1/0/0 tp_proxy_auth=0 auth_req=(nil) auth_line=(nil)
    [25327] wad_http_auth_status_proc(25478): authenticate result=challenge
    [25327] wad_hauth_trace(171): trace_no_auth_resp is disabled
    [25327] wad_http_request_get_user(25981): process=25327 auth-rule=Auth-Rule user=/0/0 ip-based/auth-cookie/transact=1/0/0 tp_proxy_auth=0 auth_req=0x7f012f900c10 auth_line=0x7f012f835ff0
    [25327] wad_hauth_method_chg_get(1376): method:http-mix->Negotiate hdr=Neg
    [25327] wad_krb_get_keytab(425): ticket's princ name:HTTP/fortigate.lo.tr@LO.TR
    [25327] wad_nego_authenticate(245): Error occurred during krb authentication.
    [25327] wad_http_auth_status_proc(25478): authenticate result=failure
     
    I am stuck, i don't know what else to do. From logs and google i couldn't find some clue what is wrong.  
    I checked  network devices, that some rule (access-list) don't block kerberos traffic, but i would see kerberos in capture from FG to AD. 
    I didn't see single kerberos packet during testing.
    LDAP (udp 389) passes during logon to FG web interface, so LDAP 389 is not blocked for sure. But still i  can't see  389 during page refresh with proxy enabled.   I hope that you can advice me.
    Kind greetings,
     
     
     
     
    #13
    xsilver
    Expert Member
    • Total Posts : 502
    • Scores: 129
    • Reward points: 0
    • Joined: 2015/02/02 03:22:58
    • Location: EMEA
    • Status: offline
    Re: Kerberos Authentication Configuration 2020/02/17 07:29:27 (permalink)
    0
    I guess you did 'ktpass' and gathered your keytab.
    Then somehow converted to Base64 ... there might be some problems with conversion.
    On Windows what worked for me is 'certutil -encode  keytab.file  keytab.file.base64.encoded
    Pay attention to FGT config and case sensitivity on principal string .. protocol is uppercase as well as realm (that stuff @REALM-HERE), FGT's serving domain in between can be lowercase
    Talking about:
    set principal "HTTP/fgt.test.local@TEST.LOCAL
     
    Make sure you have OK connection to LDAP set in 'config user krb-keytab'
     

    Kind Regards,
    Tomas
    #14
    learningall555555
    New Member
    • Total Posts : 3
    • Scores: 0
    • Reward points: 0
    • Joined: 2020/01/29 03:25:27
    • Status: offline
    Re: Kerberos Authentication Configuration 2020/02/18 00:46:37 (permalink)
    0
    I tried with certuil as you suggested, same string only separated evenly. Tried copy paste as is with "", and in one line, same error.
    It is like FG don't even start "kerberos auth check process" because i can't see any traffic on TCP/UDP port 88.
    Even with wrong keytab i would see some TCP/UDP 88 to AD.
    Can I somehow get better debug from kerberos process ?
     
    While testing keytab on linux with kinit, tcpdump showed "TCP 88" packets, and returned no error.
    After checked with klist i can see ticket in linux so keytab must be ok.
    Keytab was generated on W2016 AD.
     
    Here is FG configuration of krb-keytab and ldap without passwords and keytab.

    #configuration of krb-keytab and ldap.
    # ldap test return success.
    edit "ldap-kerberos"
    set server "192.168.0.10"
    set cnid "cn"
    set dn "dc=lo,dc=tr"
    set type regular
    set username "lo\\FortigateFirewall"
    set password ENC lld.....
    next
    #krb-keytab
    config user krb-keytab
    edit "http_service"
    set principal "HTTP/fortigate.lo.tr@LO.TR"
    set ldap-server "ldap-kerberos"
    set keytab "......................................................."
    next
    end
     
    On linux tested keytab with:
    kinit -k -t fortigate.keytab HTTP/fortigate.lo.tr@LO.TR
    #no error
    klist
    #result new ticket i can see by time.
    Default principal: HTTP/fortigate.lo.tr@LO.TR
    Valid starting Expires Service principal
    02/17/2020 17:56:40 02/18/2020 03:56:40 krbtgt/LO.TR@LO.TR
    #15
    Jump to:
    © 2020 APG vNext Commercial Version 5.5