Home

Document Library

Support

Fuse





  • All Files

Home

External Authentication Settings

This screen allows you to define servers for external user authentication. Once one or more authentication server profiles have been defined, users of the system can be configured to be authenticated locally, or by one or more of these external authentication servers. To configure a user for external authentication, select that user from the CMDB > Users screen, and select External as the authentication mode. If more than one authentication profile is associated with a user, then the servers will be contacted one by one until a connection to one of them is successful. Once a server has been contacted, if the authentication fails, the process ends, and the user is notified that the authentication failed.

The following section describes the procedure to configure External Authentication Settings:

Adding External Authentication settings

Prerequisites

The following sections provide prerequisites steps before setting up external authentication in FortiSIEM.

Note: RADIUS and Okta follow the same authentication set up process.

Adding Users from Active Directory via LDAP

If you want to add users to your FortiSIEM deployment from an Active Directory server over LDAP, you must first add the login credentials for your server and associate them to an IP range, and then run the discovery process on the Active Directory server. If the server is discovered successfully, then all the users in that directory will be added to your deployment. You then must set up an authentication profile, which will become an option you can associate with users as described in Adding Users.

Creating Login Credentials and Associating with an IP Address

  1. Log in to your Supervisor node.
  2. Go to ADMIN> Setup > Credentials.
  3. Click New.
  4. Enter a Name.
  5. For Device Type, select Microsoft Windows.
  6. Select your Access Protocol.
    FortiSIEM supports these LDAP protocols:

    7. Protocol Settings
    LDAP [Required] IP Host - Access IP for LDAP
    Port - Non-secure version on port 389
    LDAPS [Required] IP Host - Access IP for LDAPS
    Port - Secure version on port 636
    LDAP Start TLS [Required] IP Host - Access IP for LDAP Start TLS
    Port - Secure version on port 389

  7. For Used For, select Microsoft Active Directory. 
  8. For Base DN, enter the root of the LDAP user tree. 
  9. Enter the NetBIOS/Domain for your LDAP directory.
  10. Enter the User Name for your LDAP directory.
    For user discovery from OpenLDAP, specify the full DN as the user name. For Active Directory, use your server login name.
  11. Enter and confirm the Password for your User Name. 
  12. Click Save.
    Your LDAP credentials will be added to the list of Credentials.
  13. Under Enter IP Range to Credential Associations, click Add. 
  14. Select your LDAP credentials from the list of Credentials. Click + to add more.
  15. Enter the IP/IP Range or host name for your Active Directory server.
  16. Click Save.
    Your LDAP credentials will appear in the list of credential/IP address associations.
  17. Click Test > Test Connectivity to make sure you can connect to the Active Directory server.

Discovering the Active Directory Server and Users

  1. Go to ADMIN> Discovery.
  2. Click Add.
  3. For Name, enter Active Directory.
  4. For Include Range, enter the IP address or host name for your Active Directory server. 
  5. Leave all the default settings, but clear the Discover Routes under Options. 
  6. Click OK.
    Active Directory will be added to the list of discoverable devices.
  7. Select the Active Directory device and click Discover. 
  8. After discovery completes, go to CMDB > Users to view the discovered users. 
    You may need to click Refresh for the user tree hierarchy to load.

Adding Users from Okta

Follow the procedures below to add users from Otka.

Configuring Okta Authentication

To use Okta authentication for your FortiSIEM deployment, you must set up a SAML 2.0 Application in Okta, and then use the certificate associated with that application when you configure external authentication.

  1. Log into Okta.
  2. In the Applications tab, create a new application using Template SAML 2.0 App. 
  3. Under Settings, configure the settings similar to the table below:
    Post Back URLPost Back URL
    Application labelFortiSIEM Demo
    Force AuthenticationEnable
    Post Back URLhttps://<FortiSIEMIP>/phoenix/okta
    Name ID FormatEmailAddress
    RecipientFortiSIEM
    Audience RestrictionSuper
    authnContextClassRefPasswordProtectedTransport
    ResponseSigned
    AssertionSigned
    RequestUncompressed
    Destinationhttps://<FortiSIEMIP>/phoenix/okta
  4. Click Save.
  5. In the Sign On tab, click View Setup Instructions.
  6. Click Download Certificate. 
  7. Follow the instructions below and enter the downloaded certificate for Okta authentication. 

Creating an Okta API Token

  1. Log in to Okta using your Okta credentials. 
  2. Got to Administration > Security > API Tokens.
  3. Click Create Token.
    You will use this token when you set up the Okta login credentials in the next section. Note that this token will have the same permissions as the person who generated it. 

Creating Login Credentials and Associating Them with an IP Address

  1. Log in to your Supervisor node.
  2. Go to ADMIN> Setup > Credentials.
  3. Click New.
  4. Enter a Name.
  5. For Device Type, select OKTA.com OKTA.
  6. For Access Protocol, select OKTA API.
  7. Enter the Pull Interval in minutes.
  8. Enter the Domain associated with your Okta account.
    For example, FortiSIEM.okta.com. 
  9. Enter and reconfirm the Security Token you created.
  10. Enter any related information in Description.
  11. Click Save.
    Your Okta credentials will be added to the list of Credentials.
  12. Under Enter IP Range to Credential Associations, click New. 
  13. Enter the IP/IP range or host name for your Okta account.
  14. Select your Okta credentials from the list of Credentials. Click + to add more.
  15. Click Save.
    Your Okta credentials will appear in the list of credential/IP address associations.
  16. Click Test > Test Connectivity to make sure you can connect to the Okta server.

Discovering Okta Users

If the number of users is less than 200, then Test Connectivity will discover all the users. Okta API has some restrictions that do not allow FortiSIEM to pull more than 200 users. In this case, follow these steps:

  1. Log in to Okta.
  2. Download user list CSV file (OktaPasswordHealth.csv) by visiting Admin > Reports > Okta Password Health.
  3. Rename the CSV file to all_user_list_%s.csv. (%s is the placeholder of token obtained in Create an Okta API Token - Step 3, e.g. all_user_list_00UbCrgrU9b1Uab0cHCuup-5h-6Hi9ItokVDH8nRRT.csv).
  4. Log in to FortiSIEM Supervisor node:
    1. Upload CSV file all_user_list_%s.csv to this directory /opt/phoenix/config/okta/
    2. Make sure the permissions are admin and admin (Run chown -R admin:admin /opt/phoenix/config/okta/)
    3. Go to ADMIN > Setup > Credentials > Enter IP Range to Credential Associations.
    4. Select the Okta entry and run Test > Test connectivity to import all users.

Adding 2-factor Authentication via Duo Security

Obtain keys for FortiSIEM to communicate with Duo Security

  1. Sign up for a Duo Security account: signup.
    This will be admin account for Duo Security.
  2. Log in to Duo Security Admin Panel and navigate to Applications.
  3. Click Protect an Application. Locate Web SDK in the applications.
  4. Get API Host Name, Integration key, Secret key from the page.
    You will need it when you configure FortiSIEM.
  5. Generate Application key as a long string.
    This is a password that Duo Security will not know. You can choose any 40 character long string or generate it as follows using python

    import os, hashlib

    print hashlib.sha1(os.urandom(32)).hexdigest()

Create and Manage FortiSIEM users in Duo Security

This determines how the 2-factor authentication response page will look like in FortiSIEM and how the user will respond to the second-factor authentication challenge:

  1. Log in to Duo Security as admin user.
  2. Choose the Logo which will be shown to users as they log on.
  3. Choose the super set of 2-factor Authentication Methods.
  4. Optional - you can create the specific users that will logon via FortiSIEM. If the users are not pre-created here, then user accounts will be created automatically when they attempt 2-factor authentication for the first time.

Setup External Authentication Profiles

Add LDAP, LDAPS, and LDAPTLS authentication profile as follows:

  1. Go to ADMIN > Settings > General > Authentication.
  2. Click New.
  3. Enter Name.
  4. Select Organization.
  5. Set Protocol as LDAP or LDAPS or LDAPTLS.
  6. Set IP/Host of LDAP server.
  7. Change the port if it is different than default port.
  8. Check Set DN Pattern if needed by filling in the DN Pattern field.
    Setting the DN pattern manually is not necessary if the user is discovered via LDAP. However, this feature allows you to manually override the discovered pattern, or enter it for a user that is being manually created. Enter %s to represent the user's name (CN/uid), for example:
    CN=%s,CN=Users,DC=accelops,DC=com
  9. Click Save

Add RADIUS authentication profile as follows:

  1. Go to ADMIN> Settings > General > Authentication.
  2. Click New.
  3. Enter Name.
  4. Select Organization.
  5. Set Protocol as RADIUS.
  6. Set IP/Host of RADIUS server.
  7. Change and set Authen Port if the port is different from default.
  8. Enter Shared Secret.
  9. Click on CHAP if Radius server uses Challenge Handshake Authentication Protocol.
  10. Click Save.

Add Okta authentication profile as follows:

  1. Go to ADMIN> Settings > General > Authentication.
  2. Click New.
  3. Enter Name.
  4. Select Organization
  5. Set Protocol as "Okta".
  6. Copy and paste the certificate you downloaded in Configuring Okta Authentication - step 6 to Certificate.
  7. Click Save.

Add 2-factor authentication option for FortiSIEM users

  1. Create a 2-factor authentication profile:
    1. Go to ADMIN> Settings >General > Authentication.
    2. Click New.
      1. Enter Name.
      2. Select the organization from the Organization drop-down
      3. Set the Protocol as 'Duo'.
      4. Set the IP/Host from API hostname in Step 4 above.
      5. Set the Integration key, Secret keyfrom Step 4 above.
      6. Set the Application key from Step 5 above.
      7. Click Save.
  2. Add the 2-factor authentication profile to an user:
    1. Go to CMDB > Users > Ungrouped.
    2. Click New to create a new use or Edit to modify a selected user.
    3. Select System Admin checkbox and click the edit icon.
    4. In the Edit User dialog box, enter and confirm a password for a new user.
    5. Select the Second Factor check-box.
    6. Select the 2-factor authentication profile created in Step 1 above.
    7. Select a Default Role from the drop-down list.
    8. Click Save.

Log in to FortiSIEM using 2-factor authentication

Before logging in to FortiSIEM with 2-factor authentication, make sure that these steps are completed.

  1. Obtain keys for FortiSIEM to communicate with Duo Security.
  2. Create and Manage FortiSIEM users in Duo Security.
  3. Add 2-factor authentication option for FortiSIEM users.

Follow these steps:

  1. Log on to FortiSIEM normally (first factor) using the credential defined in FortiSIEM - local or external in LDAP.
  2. If the 2-factor authentication is enabled, the user will now be redirected to the 2-factor step.

    1. ŸIf the user is not created in the Duo system (by the Duo admin), a setup wizard will let you set some basic information like phone number and ask you to download the Duo app.
    2. If the user already exists in FortiSIEM, then follow the authentication method and click Log in.
    The user will be able to log in to FortiSIEM.

Authenticating users against FortiAuthenticator (FAC)

FortiSIEM authenticates users against FortiAuthenticator (FAC) via RADIUS. User credentials are either stored in the FAC local database, or in an external credential store such as Active Directory (AD), accessed via LDAP. FAC optionally applies 2-factor authentication to users with the FortiToken.

The following sections provide information about the configurations and steps to log in and troubleshoot:

  1. Configure AD users
  2. Configure FortiAuthenticator
  3. Configure FortiSIEM

Configure AD users

  1. Install AD Domain Services following the steps here.
  2. Configure the test domain users:
    1. Server Manager > Tools > Active Directory Users and Computers.
    2. Expand the Domain, right-click Users, select New > User.

Configure FortiAuthenticator

  1. Perform the basic FAC setup following the steps in the FortiAuthenticator Administration Guide: Section: FortiAuthenticator-VM image installation and initial setup here.
    1. Use the default credentials:
      • user name: admin
      • password: <blank>
    2. At the CLI prompt enter the following commands:
      • set port1-ip 192.168.1.99/24
      • set default-gw 192.168.1.2
      Note that the CLI syntax has changed in FAC 5.x. Refer to FAC 6.x documentation for details.
    3. Log in to the FAC GUI (default credentials user name / password: admin / <blank>).
    4. Set the time zone under System > Dashboard > Status > System Information > System Time.
    5. Change the GUI idle timeout for ease of use during configuration, if desired: System Administration > GUI Access > Idle Timeout.
  2. Configure the DC as a remote LDAP server under Authentication > Remote Authentication Servers > LDAP.
    Follow the instructions in the FortiAuthenticator - FSSO Authentication User Guide.Note that the user must have appropriate privileges. The Domain Admin account can be used for testing in a lab environment. The ‘Remote LDAP Users’ section will be blank at this stage, users are imported later.
  3. Configure an external Realm to reference the LDAP store:
    1. Select Authentication > User Management > Realms > Create New.
    2. Choose the LDAP source from the drop-down and click OK.
  4. Configure the FortiSIEM as a RADIUS Client:
    1. Select Authentication > RADIUS Service > Clients > Create New.
    2. Enter the IP address of FortiSIEM and a shared secret.
    3. Choose the realms as required.
    4. Click 'add a realm' to include multiple realms.
      Note the FAC evaluation license only supports 2 realms.
    5. Click Save.
  5. Import users from LDAP to FortiSIEM to allow FortiToken to be used:
    1. Select Authentication > User Management > Remote Users.
    2. Select the Import button.
    3. Choose and import the test users configured in AD. Note that the FAC Evaluation license is limited to 5 users.
  6. (Optional) Configure local users in the FAC database for local authentication under Authentication > User Management > Local Users.
  7. Provision the FortiToken:
    1. Select and edit the user in Authentication > User Management > Remote Users (or Local Users as appropriate).
    2. Select the Token Based Authentication check box, and assign an available FortiToken Mobile.
      FAC evaluation includes 2 demo FortiTokens.
    3. Choose Email delivery method and enter an email address in user information.
      The email address doesn’t have to be valid for basic testing, the provisioning code is visible in the FAC logs.
    4. Click OK.
  8. Configure the FortiToken iPhone app:
    1. Install the FortiToken app from the app store.
    2. Open the app and select the + icon in the top right corner.
    3. Choose enter manually from the bottom of the screen.
    4. Select and edit the user in Authentication > User Management > Remote Users (or Local Users as appropriate).
    5. Select the Token Based Authnetication check box, and assign an avaialble FortiToken Mobile. FAC eval includes 2 demo FortiTokens.
    6. Choose Email delivery method and enter an email address in user information. The email address doesn’t have to be valid for basic testing, the provisioning code is visible in the FAC logs.
    7. Click OK.

Configure FortiSIEM

Step 1: Configure an External Authentication Source
  1. Go to ADMIN> Settings > General > Authentication.
  2. Click New.
  3. Enter the following settings:
    • Organization - System
    • Protocol - RADIUS
    • IP/Host - IP of FortiAuthenticator
    • Shared Secret - Secret configured when setting RADIUS Client in FAC
  4. Click Save.
  5. Click Test to test the authentication settings.
Step 2: Configure users in FortiSIEM database
  1. Go to CMDB > Users and click New.
  2. Enter the user name to match the user configured in FSM/AD. (Use the format: user@domain.com)
  3. Select the System Admin checkbox.
  4. Select the Mode as External.
  5. Select the RADIUS profile previously configured from Authentication Profiles.
  6. Select the Default Role from the list.
  7. Click Save.

Logging In

The User Name must be entered in the format user@domain.xyz. For 2-factor authentication, the password and FortiToken value must be concatenated and entered directly into the Password field.

For example:

  • Username: user123@testdomain.local
  • Password : testpass123456; where 123456 is the current FortiToken value

Troubleshooting

FortiAuthenticator logs are accessible by opening the Logging tab. Select a log entry to see more details.

Modifying External Authentication settings

Complete these steps to modify External Authentication settings:

  1. Use the following buttons to modify External Authentication settings:
    • Edit - to modify an External Authentication setting.
    • Delete - to delete an External Authentication setting.
  2. Click Save.
 

Copyright © 2019 Fortinet, Inc. All Rights Reserved. | Terms of Service | Privacy Policy