Authenticate with AD user

[RicardoPQ-com]

I can't find a way to authenticate a vpn gateway which requires "domain\username" login. ¿Has somebody tried it? I've google a lot and found nothing about it.

[DimitriPapadopoulos]

What have you tried so far? "DOMAIN/login" and "DOMAIN\login"? How does it work with the official client?

[RicardoPQ-com]

Yes, I tried with both forms. In the official client it works ok, I just write my "domain\username" in the Username field.

[DimitriPapadopoulos]

This might be a terminology issue. Perhaps what you call domain, Fortinet call realm.

Try --realm=DOMAIN --user=login.

[RicardoPQ-com]

Actually I tried that too, but no luck yet

[DimitriPapadopoulos]

Have you enclosed DOMAIN\login in quotes? Like --user='DOMAIN\login'?

[DimitriPapadopoulos]

Otherwise, it won't be possible to help without logs.

Chances are you need to authenticate on a web page with JavaScript, which is beyond the capability of a command line program. Try authenticating directly in a web browser, retrieving the cookie, and feeding it to openfortivpn.

[VVD]

For me it work without any "domain" and "realm" - just "username = USER" in config file.
Server's admin send "DOMAIN\USER".

[peterhoeg]

It's the firewall that's responsible for setting the domain (or realm) so as @VVD says, username = some.user.name is all that's needed. Using this scenario almost every day for multiple customers.

[DimitriPapadopoulos]

Don't new Fortinet firewalls offer 2FA which may require to open a web page with JavaScript in a browser?

I don't have access to such a Fortinet appliance myself, but I thought newer firewalls may support such configurations that a command line program cannot easily support.

[peterhoeg]

Don’t new Fortinet firewalls offer 2FA which may require to open a web page with JavaScript in a browser?

I’ve made a note of trying that out.

[DimitriPapadopoulos]

Thanks. See also:

• Allow to delegate the authentication to external programs #974 added option --cookie-on-stdin to use an existing session cookie instead of authenticating.
• In SAML/SSO/2FA support #1042 we decided not to link with WebKitGTK to support SAML/SSO/2FA, and instead rely on an external command/script such as https://github.com/gm-vm/openfortivpn-webview to retrieve the session cookie and pass it to openfortivpn using --cookie-on-stdin.

[DimitriPapadopoulos]

@RicardoPQ-com Have you tried plain --user=username, completely dropping domain?