Ldap servers – Fortinet FortiGate v3.0 MR7 User Manual
Page 19
Authentication servers
LDAP servers
FortiOS v3.0 MR7 User Authentication User Guide
01-30007-0347-20080828
19
To remove a RADIUS server from the FortiGate unit configuration - CLI
config user radius
delete
end
LDAP servers
Lightweight Directory Access Protocol (LDAP) is an Internet protocol used to
maintain authentication data that may include departments, people, groups of
people, passwords, email addresses, and printers. An LDAP consists of a data-
representation scheme, a set of defined operations, and a request/response
network.
The scale of LDAP servers ranges from big public servers such as BigFoot and
Infospace, to large organizational servers at universities and corporations, to
small LDAP servers for workgroups. This document focuses on the institutional
and workgroup applications of LDAP.
A directory is a set of objects with similar attributes organized in a logical and
hierarchical way. Generally, an LDAP directory tree reflects geographic and/or
organizational boundaries, with the Domain name system (DNS) names to
structure the top level of the hierarchy. The common name identifier for most
LDAP servers is cn, however some servers use other common name identifiers
such as uid.
If you have configured LDAP support and a user is required to authenticate using
an LDAP server, the FortiGate unit contacts the LDAP server for authentication.
To authenticate with the FortiGate unit, the user enters a user name and
password. The FortiGate unit sends this user name and password to the LDAP
server. If the LDAP server can authenticate the user, the user is successfully
authenticated with the FortiGate unit. If the LDAP server cannot authenticate the
user, the connection is refused by the FortiGate unit.
Binding is the step where the LDAP server authenticates the user, and if the user
is successfully authenticated, allows the user access to the LDAP server based
on that user’s permissions.
The FortiGate unit can be configured to use one of three types of binding:
•
anonymous - bind using anonymous user search
•
regular - bind using username/password and then search
•
simple - bind using a simple password authentication without a search
You can use simple authentication if the user records all fall under one dn. If the
users are under more than one dn, use the anonymous or regular type, which can
search the entire LDAP database for the required user name.
If your LDAP server requires authentication to perform searches, use the regular
type and provide values for username and password.
The FortiGate unit supports LDAP protocol functionality defined in
RFC 2251: Lightweight Directory Access Protocol v3, for looking up and validating
user names and passwords. FortiGate LDAP supports all LDAP servers compliant
with LDAP v3. In addition, FortiGate LDAP supports LDAP over SSL/TLS. To
configure SSL/TLS authentication, refer to the