Troubleshooting Tip: FortiToken stuck in pending status after email sending failure

Description

This article describes a technical issue where the FortiToken status is displayed as 'Pending' in FortiAuthenticator after a failure in sending the email with the activation code to the users. The FortiToken does not return to available status automatically.

Scope

FortiAuthenticator.

Solution

In the following scenario, the users are imported to FortiAuthenticator through 'Remote user sync rules', assigning a FortiToken Mobile automatically.

Upon assigning the token, an email containing the activation code is sent to the user. The e-mail sending fails and the error logs show 'no valid recipients':

This error is caused by the wrong email information being imported from the AD server.

The token gets 'Pending' status without a user assigned. The 'Last Used' field shows the time of the last attempt to assign it. Go to Authentication -> User Management -> FortiTokens:

Using the 'Re-start Activation' button does not solve the issue:

The token will get stuck in its 'Pending' status and will be unavailable for new assignments.

To get the tokens back to the 'Available' status, select the 'Refresh FTM' button. Go to Authentication -> User Management -> FortiTokens -> Refresh FTM.

In the current design, it is expected that the token is in the 'Pending' status upon assignment to a user, until either timeout occurs or the user activates the token.

However, in the event of a failure to send out the token activation code, FortiAuthenticator will keep the token in the 'Pending' state. This design will change in version 8.0.4, where the FortiToken Mobiles will be moved back to 'Available' automatically if the sending email activation code fails.