Fortigate -- Setup LDAP server for SSL-VPN client authentication on Fortigate

Our office located on three area and have to provide SSL-VPN for mobile users to connect to access office resource. We are using Local user accounts on Fortigate for SSL-VPN client authentication.If users requested that he/she needs to access to all office's VPN, i need to create three accounts. It is not smart.
To simplify the process and centralize the authentication, I decided to use Windows 2008 AD as LDAP server and setup LDAP authentication on three fortigate to reduce the management process.

On Windows 2008:
1. Create a group on AD for SSL VPN clients. (SSLVPN Group)
2. Create an account on AD and as a member of "SSLVPN Group"

 On Fortigate:
3. User -> Remote, on LDAP tab, click "Create New" icon.
4. Fill in the information. (See below for example)
- Name: SSLVPN Client
- Server Name/IP: 192.168.2.2
- Server Port: 389 (default)
- Common Name Identifier: sAMAccountName (Can select one of AD account attributes.
  ex: cn or userPrincipalName)
- Distinguished Name:

  ex1: ou=TPE,dc=ppp,dc=corp (User account need to belong to "TPE" ou for authentication.

          the account in other ou or container (no matter parent or syb) will not be allowed.

  ex2: dc=ppp,dc=corp (user can belong to any ou or container under domain for authentication
           This method can work with group restrict to manage account. Please refer Note below.)
- Bind Type: Regular
- Filter: (&(objectcategory=group)(member=*)) <-- this is default value
- User DN: cn=user1,ou=users,ou=tpe,dc=ppp,dc=corp (For AD authentication to get
   the AD information)
- Password: password
- Secure Connection: not selected

Note:
Because we need to have a group to restrict the user account on SSL VPN accessing.
We need to add one more setting on Fortigate through CLI.
TPE-FW #config user ldap
TPE-FW (ldap) #edit "SSLVPN"
TPE-FW (SSLVPN) #set group "cn=SSLVPN Group,ou=Permission_Group,ou=TPE,dc=ppp,dc=corp"
end

Refer the document:
http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=13141&sliceId=1&docTypeID=DT_KCARTICLE_1_1&dialogID=1326745&stateId=0%200%201324960