FMC External Authentication Failing

mumbles202 — Wed, 15 Apr 2020 18:12:35 GMT

I'm trying to setup external authentication for a 6.5 FMC but running into some issues. Currently the FMC has LDAP authentication setup for AnyConnect connectivity, and if i try to Fetch DNs or Fetch Attrib those both return values, but when I try to test a user that I know is in the group by domain\user1 or just entering user1 it fails. Active Directory is 2016. I'm currently using the following settings:

Base Dn - dc=domain,dc=local

UI Access Attribute - sAMAccountName
Shell Access Attribute - sAMAccountName

Administrator - CN=ftdaccess,OU=Security Groups,DC=domain,DC=local
Group Member Attribute - memberOf (I also tried just member w/ the same results)
Shell Access Filter - Same as Base Filter is checked

When I expand the test results i do see the following:

The server query size limit was exceeded. Use the Base Filter to reduce the number of records retrieved.
See Test Output for details.
Error
Test Failed: The search for your test user using your current parameters failed; please verify your authentication settings and test user credentials.
External Authentication Object
Authentication Method
CAC Use for CAC authentication and authorization
Name
LDAP
Description
LDAP Authentication FMC
Server Type
Primary Server
Host Name/IP Address
172.16.20.25
ex. IP or hostname
Port
389

The test user in question is a member of 2 groups (Domain Users and ftdaccess). Should I set the base DN to a path that mirrors the OU that members of the group should be limited to?

Re: FMC External Authentication Failing

mumbles202 — Wed, 15 Apr 2020 20:39:27 GMT

So i figured out the first issue and I'm now able to successfully test using ldap after changing the base dn to , but if i try to use ldaps it fails. I have the cert from the server exported as a base 64 file and when i try to browse and upload it is takes the setting but if I save it the settings save but the cert disappears when you go back in. Is there a requirement that I'm missing in order to get LDAPS for the external authentication?

topic Re: FMC External Authentication Failing in Network Security

FMC External Authentication Failing

Re: FMC External Authentication Failing

Re: FMC External Authentication Failing