IPsec/SSL VPN

 View Only

Problem with security groups and ldap users

  • 1.  Problem with security groups and ldap users

    Posted Feb 11, 2022 02:55 AM
    Hi,

    We have discovered that several users seem to end up in several LDAP groups when they connect via vpn client (forticlient). Every user is a member of a specific group on our Active Directory and even though they are not member of a certain group, when they connect via vpn client I can see that they end up in these User Group.

    For example:

    Lets say we have these groups under the User & Authentication -> User Groups:

    - Group 1 (remote group 1)
    - Group 2 (remote group 2)
    - Group 3 (remote group 3)

    Remote group 1, 2 and 3 are groups that are created on the AD server and synced with the User Groups on fortigate.

    User A is a member on remote group 1 on the AD, but when he log in via vpnclient, even though it is not a member of the remote group 2 on the AD, he ends up even in this group on the fortigate. 

    We are running FortiOS v6.4.8. 

    Does anyone has any idea why is the fortigate behaving like this?

    Best Regards