Technical Tip: How to setup FortiGate to use custom LDAP attribute from which to get group membership

[fquerzo_FTNT]

Description
In some environments, the LDAP group memberships are defined in a custom LDAP attribute (not in the default memberOf).
This article describes how to set the FortiGate up for such cases and how to create and apply user group in the firewall policy via CLI.

Solution
The LDAP server attribute <custom_attribute> hold group <ldap_group_name>.

Setting up LDAP configuration:

#config user ldap
edit <ldap_name>
set group-member-check user-attr
set member-attr <custom_attribute>
end

Creating a user group:

#config user group
edit <group_name>
set member <ldap_name>
config match
edit 1
set server-name <ldap_name>
set group-name <ldap_group_name>
end
end

Applying the group in the IPv4 firewall policy:

#config firewall policy
edit <policy_ID>
set groups <group_name>
end

Related Articles

Technical Tip : How to configure LDAP server and restrict access to certain groups in FortiOS 4.0MR2...