Troubleshooting Tip: User's session is not terminated after the approval request is revoked by the approver on FortiPAM
Description
This article explains why a user’s session for a secret accessed through an approval request does not terminate if the approver subsequently revokes the approval after it has been approved on FortiPAM. If the user launches the secret immediately (or until the approval is revoked) after the request is approved and the approver later revokes or denies the request, the user’s session remains active until the browser tab is closed or the request duration is over.
Scope
FortiPAM.
Solution
The reproduction steps are as follows:
The user submits a request for a secret and specifies the desired duration.
Approver receives the request and approves it.
The user launches the secret after the request is approved and accesses the target.
Approver revokes the approval after the user accesses it but the user's session does not terminate and continues on the same browser tab until it is closed.
To fix it:
The 'Web Proxy' option must be enabled in the target settings, as well as the 'explicit web-proxy' option in the related interface.
After the approval is revoked, the expected '403 Forbidden' page will be displayed in the browser if the user refreshes the page or attempts to access any settings on the target.
Related articles:
