Helpful ReplyHot!AD & FSSO User authentication

Author
Murali S L
New Member
  • Total Posts : 4
  • Scores: 0
  • Reward points: 0
  • Joined: 2019/11/10 23:16:21
  • Status: offline
2019/11/10 23:45:20 (permalink)
0

AD & FSSO User authentication

Hi,
We have Fortinet 201E with LDAP configured. The web policy is configured based on user groups & AD is forwarding wrong user names to collector agent. Instead of logged in user, it is forwarding Domain\Administrator & the internet wont work for that user. We have upgraded the firmware to the latest & reinstalled latest FSSO agent. Still unable to resolve the issue. Request for help
Thanks in advance
Regards
Murali S L
#1
xsilver
Expert Member
  • Total Posts : 453
  • Scores: 103
  • Reward points: 0
  • Joined: 2015/02/02 03:22:58
  • Location: EMEA
  • Status: offline
Re: AD & FSSO User authentication 2019/11/12 00:11:35 (permalink)
0
Hi Murali,
set Collector log level to debug and have a look what users were processed from affected workstation name/IP.
Similar situation usually happens when there are background apps/agents/proxies on workstation, run under different or service accounts. As those need to authenticate to domain as well, their logon will overwrite logon made by user.
Use of 'RunAs..' also affect this.
If you do have some backend app run under administrator/service account then you can:
- change setup of that app to use some service account (could be admin group member, but not directly admin)
- add all those service accounts to Ignore List on Collector, so their logons will be completely ignored from processing and so they will stop overwriting regular user's FSSO records
 

Kind Regards,
Tomas
#2
Murali S L
New Member
  • Total Posts : 4
  • Scores: 0
  • Reward points: 0
  • Joined: 2019/11/10 23:16:21
  • Status: offline
Re: AD & FSSO User authentication 2019/11/12 03:14:46 (permalink)
0
Hi Tomas,
Thanks for the help. We have checked affected systems for any background apps running as administrator & nothing found. This is happening on more than 70 systems with mixed OS (Windows 10, 7 & XP as well).
 
Collector log level put to DEBUG, affected user host name & IP is correctly captured except user name. It is Domain\Administrator.
 
Added administrator account to ignore list & Internet doesn't work.
 
Thanks
Murali S L
#3
Maciej
New Member
  • Total Posts : 5
  • Scores: 0
  • Reward points: 0
  • Joined: 2017/02/16 01:54:14
  • Status: offline
Re: AD & FSSO User authentication 2019/11/12 22:18:19 (permalink)
0
Hello, 
my problem with FSSO was that, if user logged in to computer and then to any internal app with AD credentials, this last logon was read as if domain controller was the last known source of authentication. 
 
This can be a similar case. 
 
This help : https://kb.fortinet.com/kb/php/search.do?cmd=displayKC&docType=kc&externalId=FD45566&sliceId=1&docTypeID=DT_KCARTICLE_1_1&dialogID=163144424&stateId=0%200%20163146264%27) (Technical Tip: Excluding IP addresses from FSSO logon events)
#4
xsilver
Expert Member
  • Total Posts : 453
  • Scores: 103
  • Reward points: 0
  • Joined: 2015/02/02 03:22:58
  • Location: EMEA
  • Status: offline
Re: AD & FSSO User authentication 2019/11/13 03:29:25 (permalink) ☄ Helpfulby Murali S L 2019/11/15 20:37:05
0
So if I got it correctly then you do have regular user, logging into workstation, but FSSO took from DC that logged on user is Administrator.
That user simply logged into workstation (which is part of domain, joined properly) and did NOT run any app under another domain account. Haven't used 'RunAs..' windows feature. There is no background app/service running under Administrator privileges found on workstation. And user is still reported to domain as Administrator.
 
Use simple tools on workstation to check what is logged on user and which DC was used to verification.
Then check logons on DC in Windows Security log.
Compare to Collectoragent.log and FortiGate's FSSO records.
That, checked over time, or with test workstation logon when you do observe progress of that logon being processed, should show you where the issue starts.


B.2. Workstation’s output under affected user account
ipconfig /all
whoami
ping -4 -n 2 %logonserver:~2%
net use
time /T
date /T
qwinsta
sc query RemoteRegistry
 
B.3. on FortiGate collect output of those commands (log console output to text file, SSH connection preferred over direct console for its speed):

get system stat
diag debug reset
diag debug en
diag debug authd fsso server-status
diag debug auth fsso list
diag fire auth list
diag wad user list
 
Above is part of debug commands set we use in TAC to check SSO. Hope those will help. If not, kindly open standard trouble ticket with TAC and one of us will help you to resolve the situation completely.

Kind Regards,
Tomas
#5
Murali S L
New Member
  • Total Posts : 4
  • Scores: 0
  • Reward points: 0
  • Joined: 2019/11/10 23:16:21
  • Status: offline
Re: AD & FSSO User authentication 2019/11/15 20:46:32 (permalink)
0
Hi,
Apologies for the delayed response, thanks for the inputs. Will update shortly as we have opened a ticket with Fortinet
 
Regards
Murali S L
#6
Murali S L
New Member
  • Total Posts : 4
  • Scores: 0
  • Reward points: 0
  • Joined: 2019/11/10 23:16:21
  • Status: offline
Re: AD & FSSO User authentication 2019/11/15 20:48:37 (permalink)
0
Hi Tomas,
As suggested by you, we have opened a trouble ticket with fortinet & the same logs have been sought by the team.
Keep you updated once resolved.
Regards
Murali S L
 
#7
Jump to:
© 2019 APG vNext Commercial Version 5.5