Admin PKI 2FA Login

ephemeric · ‎09-05-2018

Hi,

We have created PKI users: robert, dhyata and rivaan with 2FA enabled.

We have created Administrators: robert_pki, dhyata_pki and rivaan_pki of type "Use public key infrastructure (PKI) group".

All PKI users are members of PKI group.

When I login (robert_pki), the browser asks to select cert and the login dialogue box is presented with the "User Name" field filled in with "robert_pki". I enter my 2FA password and login. That's all good.

However, when another user trys to login, using their cert in their browser, their login dialogue box when presented, already has "robert_pki" as "User name" filled in and greyed out and hence 2FA does not work for them.

If I delete robert_pki and login with 2FA dhyata_pki, it works. I create robert_pki and proceed to login with myself and see "dhyata_pki" as "User name" filled in and greyed out and hence 2FA does not work.

Tried from different workstations and hence different browsers.

I'm stumped.

Please help.

FortiOS 5.4.4 build 6003 (GA) on a FortiGate 101E.

Thank you.

emnoc · ‎09-05-2018

It could be, I play around with this on numerous browsers and even in FML and the browsers all cache items differently. If you want to PoC use "curl" and simple web-auth and avoid the browser-types.

This might help also ; http://socpuppet.blogspot.com/2017/06/mfa-using-certficates-fortios-sys-admin.html

and

http://socpuppet.blogspot.com/2018/05/how-to-check-client-certificate-tls.html

FWIW: I have a FGT60D on 5.4.56 and do not see any problems using Safari or Firefox ( i'm a mac user btw ). So if you have access to 5.4.6, upgrade and restest. V6.0 also works perfectly btw

Ken

PCNSE

NSE

StrongSwan

View solution in original post

tanr · ‎09-05-2018

I'm not sure if the PKI group setup could be part of the problem, but there was at least one rather bad bug in 5.4.4 (Bug ID: 412987) related to how the certificates were looked at by the FortiGate. See https://forum.fortinet.com/tm.aspx?m=142712 for a discussion of it.

That bug was fixed in 5.4.5, so you might want to try 5.4.5, or move up to the more recent 5.4.9 or 5.4.10.

emnoc · ‎09-05-2018

I just did a write up on this

http://socpuppet.blogspot.com/2018/05/securing-fortigate-https-admin-with-pki.html

what I have observed over a few years now; " The client web-browser type" plays a lot in the behavior for Certificate and PKI for the admin interface. Have you tried MSIE, CHROME , Safari and FF

PCNSE

NSE

StrongSwan

tanr · ‎09-05-2018

Hi Ken, nice write up.

It looks like from your example the user name, CN on the certificate, and CN set in the PKI object all need to match? The bug 412987 with 5.4.4 I ran into involved some cases where the FortiGate was not correctly matching the CN of the cert with the PKI -- don't know if that could be part of this issue or not.

ephemeric · ‎09-05-2018

@tanr: that link you posted deals with IPsec VPN, I don't see the connection?

@emnoc: great writeup and very helpful but 2FA is working, at least for one user and yes, we have tried several browsers.

The issue seems to be that the last successfully authenticated PKI peer, is displayed in the next users browser regardless of different cert etc.

Thank you for all the responses.

emnoc · ‎09-05-2018

It could be, I play around with this on numerous browsers and even in FML and the browsers all cache items differently. If you want to PoC use "curl" and simple web-auth and avoid the browser-types.

This might help also ; http://socpuppet.blogspot.com/2017/06/mfa-using-certficates-fortios-sys-admin.html

and

http://socpuppet.blogspot.com/2018/05/how-to-check-client-certificate-tls.html

FWIW: I have a FGT60D on 5.4.56 and do not see any problems using Safari or Firefox ( i'm a mac user btw ). So if you have access to 5.4.6, upgrade and restest. V6.0 also works perfectly btw

Ken

PCNSE

NSE

StrongSwan

ephemeric · ‎09-06-2018

@emnoc: thank you sir. Will test and upgrade, great info. Cheers.

ephemeric · ‎09-06-2018

Hi,

So I tested and noticed "<input type="text" name="username" id="username" value="dhyata_pki" readonly />" is wrong. "dhyata.pki" should be "robert_pki".

robert@anomaly ~/files % curl -u robert_pki --key robert_pki.key --cert robert_pki.crt --cacert ca.crt https://fortigate.gsoc.co...bsp; Enter host password for user 'robert_pki':

<!DOCTYPE html> <html class="main-app"> <head> <meta http-equiv="X-UA-Compatible" content="IE=8; IE=EDGE"> <meta http-equiv="pragma" content="no-cache"> <meta name="viewport" content="width=device-width, initial-scale=1"><link href="/82cf4c38bb25fb93045faa670fb2741c/css/jquery.ui.css" rel="stylesheet" type="text/css"> <link href="/82cf4c38bb25fb93045faa670fb2741c/css/main-green.css" rel="stylesheet" type="text/css"> <script type='text/javascript' src='/82cf4c38bb25fb93045faa670fb2741c/lang/en.js'></script> <script language="JavaScript"> if (top.location != window.location) top.location.reload(); if (window.opener) {window.opener.top.location.reload(); self.close();} </script> </head> <body> <div class="view-container"> <form class="prompt" onsubmit="return false;" method="get" name="login" autocomplete="off"> <div class="content with-header"> <div class="header"> <f-icon class="ftnt-fortinet-grid icon-xl"></f-icon></div> <div class="sub-content"><div class="wide-inputs"> <div class="error-message" id="err_msg_txt"></div> <input type="text" name="username" id="username" value="dhyata_pki" readonly /> <input type=password autocomplete="off" name="secretkey" id="secretkey" placeholder="Password"> <input type=hidden name="auth_two_factor" id="auth_two_factor" value="1"> <input type=hidden name="auth_token" id="auth_token" value="Era=1&Payload=JWckYDQSfxpNO9V8+luZ49fUNP9mN/JXcH6qIhYwzHo= &AuthHash=VPzntXhDGki8ZGKPw3CSqtfe74kA "> <label id="token_msg" style="display: none;"></label> <input type="password" autocomplete="off" name="token_code"placeholder="Token Code" id="token_code" maxlength="16" style="display: none" disabled> </div> <div class="button-actions wide"> <button class="primary" name="login_button" id="login_button" type="button"onclick="try_login();" >Login</button> </div></div></div></form></div> <script type="text/javascript" src="/82cf4c38bb25fb93045faa670fb2741c/js/login.js"></script> <script language="Javascript"> document.onkeydown = key_pressdown; document.forms[0].secretkey.focus(); </script> </body> </html>