Hot!Kerberos, explicit proxy and ad group membership change

Author
judit
Bronze Member
  • Total Posts : 23
  • Scores: 2
  • Reward points: 0
  • Joined: 2011/03/22 07:07:45
  • Status: offline
2019/04/17 07:46:52 (permalink)
0

Kerberos, explicit proxy and ad group membership change

Hi,
I have configured kerberos authentication against windows AD with explicit proxy yesterday and it works fine.
I have moved a user from an AD group to another AD group today, but the fortigate firewall still does not recognize the change of the AD group membership after serveral hours.
Is there a timeout or a value for user group lookup on the fortigate firewall?
Thanks and kind regards, Judit
#1

3 Replies Related Threads

    xsilver_FTNT
    Expert Member
    • Total Posts : 430
    • Scores: 91
    • Reward points: 0
    • Joined: 2015/02/02 03:22:58
    • Status: offline
    Re: Kerberos, explicit proxy and ad group membership change 2019/04/17 08:34:09 (permalink)
    0
    Hi Judit,
    basic concept is that once user authenticate himself, the timeout is 'idle' one.
    And so till user leave session idle for certain time he is considered authenticated and his authenticated status prolongs.
    Group membership is evaluated at the login time. And most of the login mechanisms do not handle group membership changes. With one exemption of FSSO, but even there it has to be set up explicitly.
     
    AFAIK there is no way to set group membership periodic check for firewall authentications (except mentioned FSSO on standalone Collector or FortiAuthenticator).

    Simplest way is to de-authenticate user from FGT manually and so force him to re-authenticate and so get group membership evaluated again.
    Another way is to change user settings from idle-timeout to hard and de-facto force user to re-authenticate every few minutes/hours.

    Kind Regards,
    Tomas
    #2
    judit
    Bronze Member
    • Total Posts : 23
    • Scores: 2
    • Reward points: 0
    • Joined: 2011/03/22 07:07:45
    • Status: offline
    Re: Kerberos, explicit proxy and ad group membership change 2019/05/08 04:59:14 (permalink)
    0
    Hi, thank you for your reply.
    I have configured authentication hard timeout for the user and for the user groups and have set the commando 'set ip-based disable', but the fortigate still doesn't recognize ad-group membership Change within 60 minutes.
    Is there a configuration detail missing? Thanks and kind regards, Judit



    config user setting    
    set auth-timeout 60    
    set auth-timeout-type hard-timeout
    end
    config user group
        edit "Fortigate-Web-A"
            set authtimeout 60
            set member "LDAP-Kerberos"
            config match
                edit 1
                    set server-name "LDAP-Kerberos"
                    set group-name "CN=Fortigate-Web-A,OU=Fortigate-Security-Groups,DC=XX,DC=local"
                next
            end
        next
     edit "Fortigate-Web-B"
            set authtimeout 60
            set member "LDAP-Kerberos"
            config match
                edit 1
                    set server-name "LDAP-Kerberos"
                    set group-name "CN=Fortigate-Web-B,OU=Fortigate-Security-Groups,DC=XX,DC=local"
               next
      
        next
    end
    config authentication rule
        edit "proxyauth"
            set srcaddr "all"
            set ip-based disable
            set active-auth-method "kerberos"
        next
    end
    #3
    judit
    Bronze Member
    • Total Posts : 23
    • Scores: 2
    • Reward points: 0
    • Joined: 2011/03/22 07:07:45
    • Status: offline
    Re: Kerberos, explicit proxy and ad group membership change 2019/05/16 02:25:28 (permalink)
    0
    Hi, Fortinet Support told me today to upgrade to 6.0.x
    because  in 5.6 there is no way to set a hard timeout for the proxy with kerberos.


    There are new commands introduced in 6.0 that should help you with your issue:
    config system global
    set proxy-auth-lifetime Enable/disable authenticated users lifetime control. This is a cap on the total time a proxy user can be authenticated for after which re-authentication will take place.
    set proxy-auth-lifetime-timeout Lifetime timeout in minutes for authenticated users (5 - 65535 min, default=480 (8 hours)).
    set proxy-re-authentication-mode Control if users must re-authenticate after a session is closed, traffic has been idle, or from the point at which the user was first created.
    Please see the following document:
    https://help.fortinet.com...tication%20timeout.htm
    #4
    Jump to:
    © 2019 APG vNext Commercial Version 5.5