A utility wants its FortiGate to authenticate corporate back-office staff against the existing Active Directory service used for billing and dispatch systems, without creating separate accounts. Which concept describes how the FortiGate locates and reads a user's entry in that directory during LDAP authentication?

LDAP authentication requires the FortiGate to first bind to the directory server using a configured bind distinguished name (and its password) with sufficient rights to search, then use a base DN to scope where in the directory tree it looks for the user's entry, before finally verifying the supplied password against that entry. This is a fundamentally different mechanism from RADIUS, which never involves a directory bind or a distinguished name — conflating the two by mentioning a RADIUS shared secret describes the wrong protocol entirely. ARP is a Layer 2 address-resolution mechanism for discovering a MAC address on the local segment; it plays no role in locating a directory entry across an LDAP connection. FSSO is a separate, passive identity mechanism that reads domain controller security event logs to infer who is already logged into a workstation — it does not perform the bind-and-search sequence that defines interactive LDAP authentication. A caveat worth remembering: an incorrect base DN commonly causes 'user not found' failures even when the password is correct, since the search never reaches the right part of the tree. To verify, test the LDAP server object's connectivity and confirm a known back-office username resolves under the configured base DN.