topic Re: Certificate VPN authentication against LDAP using userPrincipalName (R80.10) in SASE and Remote Access

Certificate VPN authentication against LDAP using userPrincipalName (R80.10)

Damjan_Janev — Sat, 09 Jun 2018 20:15:25 GMT

Has anyone tried and succeeded in this?

Since R80.10, sk61060 is no longer applicable and the relevant configuration is performed directly on the gateway object in VPN CLients -> Authentication. In the personal certificate i have

Fetch Username From: Subject Alternative Name.UPN in the Login option
Common lookup type: User-Principal-Name / UPN (userPrincipalName) in the User Directories

The first part seems to be working OK. I can verify in the logs that UPN is extracted from the certificate but it is not matched against an UPN in LDAP. Login fails with unknown user. If i change everything to default (DN based), it works OK.

If i change the Fetch Username From part to DN, and leave the lookup to be UPN based, authentication succeeds. Looks like the lookup is always DN based, no matter what is selected. I even tried to use custom lookup with userPrincipalName, but the behavior is the same.

I am currently testing this on R80.10 with Jumbo Hotfix Accumulator Take 91

ETA:

Tried with Hotfix Accumulator Take 103 (latest). No change.

I am currently running some packet capture of the FW-DC communication an concluded that the above configuration results in LDAP search based on sAMAccountName instead on userPrincipalName

Re: Certificate VPN authentication against LDAP using userPrincipalName (R80.10)

PhoneBoy — Sun, 10 Jun 2018 01:57:02 GMT

Even though the R80.10 GUI has an option for this, can you verify the settings are set as described in sk61060 with GUIdbedit?

I'm thinking alternative_subject_field, but maybe the other parameters as well.

Re: Certificate VPN authentication against LDAP using userPrincipalName (R80.10)

Damjan_Janev — Sun, 10 Jun 2018 10:56:49 GMT

I finally managed to make it work by using a combination of SmartConsole configuration for the username extraction part and GuiDBEdit configuration for the lookup part, but i don't think that this is the way it was intended to work. Even that took some trial and error to make it work.

Re: Certificate VPN authentication against LDAP using userPrincipalName (R80.10)

Damjan_Janev — Sun, 10 Jun 2018 13:49:01 GMT

Aaaaaaand, that is not the end of my worries. I am experiencing, a similar issue when connection with Capsule Connect on IOS. This time, even the certificate parsing is stuck to default (DN). I have modified every sk61060 related item that seemed relevant to the mobile clients, but with no success.

Re: Certificate VPN authentication against LDAP using userPrincipalName (R80.10)

PhoneBoy — Mon, 11 Jun 2018 01:27:38 GMT

Possibly this SK?

LDAP users connecting from Check Point Capsule Connect / VPN client cannot authenticate using certificate

Otherwise it's probably worth a TAC case.

Re: Certificate VPN authentication against LDAP using userPrincipalName (R80.10)

Damjan_Janev — Tue, 12 Jun 2018 06:40:20 GMT

Ended up with a TAC case. Lets see what happens next.

Re: Certificate VPN authentication against LDAP using userPrincipalName (R80.10)

OliverBayerlein — Wed, 25 Jul 2018 14:24:48 GMT

I have exactly same issue. Can you post the solution or SR number?

Re: Certificate VPN authentication against LDAP using userPrincipalName (R80.10)

SSlater — Mon, 30 Jul 2018 03:04:58 GMT

If you're using a 3rd Party Certificate, it might be overriding the configuration.

sk115637

The 3rd party Root CA has two parameters that define the user fetch process:

use_cn_to_fetch_user (default: false)

use_principal_name (default: false)

***If one of this two parameters are enabled (value=true) then the certificate parsing rules defined in the realm relevant for the VPN blade will not be applied after the certificate chain is completed.

Re: Certificate VPN authentication against LDAP using userPrincipalName (R80.10)

Damjan_Janev — Mon, 30 Jul 2018 06:42:03 GMT

The certificate parsing seems to work OK, according to the GUI settings. The subsequent LDAP search is not working properly.

Re: Certificate VPN authentication against LDAP using userPrincipalName (R80.10)

Scott_Bily — Thu, 15 Aug 2019 12:54:25 GMT

Did you ever get this solution working? I am experiencing the same thing thing.

I have been able to make it all work(including Capsule VPN logins using 3rd party certificate), In a test environment, using a combination of modifying VPN Client Authentication fields in Smart Dashboard, and editing the VPN realm using guidbedit.

But the the steps I had to take are not very intuitive, and took days of troubleshooting.

I was just wondering if TAC ever gave a reason, or better solution that didn't involve guidbedit, of if this was resolved in maybe R80.30?

Re: Certificate VPN authentication against LDAP using userPrincipalName (R80.10)

Jan_Kleinhans — Fri, 21 Oct 2022 06:27:16 GMT

Hello,

can you describe what fields you have changed in guidbedit. I am experiencing the same problem.

Regards,

Jan