New Member

Question

FTM deprovision

Forum|Forum|2 years ago
January 2, 2024
15 replies
6624 views

We are receiving following error message from few weeks,

"ftm deprovision: disabled local user because ftm activation expired. admin must be cautious to re-enable this user because it will be allowed access without token"

What can be the reason for this. These users are already activated their soft tokens and worked without any issues. Suddenly they faced this FTM deprovisioning issue.

Model: FortiAuthenticator VM

FortiAuthenticator

FortiAuthenticator v5.5

funkylicious

SuperUser

Hi,

If I recall correctly that is because the user has failed to activate the FTK in the allocated time, which is configurable.

https://community.fortinet.com/t5/FortiAuthenticator/Technical-Tip-FortiAuthenticator-Expired-FTM-Activation/ta-p/190187

"jack of all trades, master of none"

SMKAuthor

New Member

Hi,

These users are not new; they have already activated their tokens and worked well without any issues for a long time. Suddenly, they have faced this issue.

As per my understanding, we don't need to worry about the initially allocated time after activation. Once activated it will work. Please correct me if I'm wrong.

funkylicious

SuperUser

Hi,

You are correct, this should not affect existing users and already activated tokens.

It might be a case were you should engage TAC in order to figure out where the issue might be, because if this happened to existing users it might indicate a issue.

"jack of all trades, master of none"

readerik

New Member

Our organization is facing the same issue since last few days. With over 1000 users total, we have random accounts being deprovisioned.

Which fortiAC version are you using?

fcatena

New Member

we are in 6.4.8

gmsrt_69

New Member

6.4.1

SMKAuthor

New Member

Hi All,

Does anyone had a chance to resolve this issue? Please share.

akanibek

Staff

Dear @SMK,

could you tell me your FAC version? Have you made any upgrade?

fcatena

New Member

Hi everyone,
I'm also having the same problem,

Fortinet says to try rebooting the FAC, the service that needs to contact fortitokenmobile.fortinet.com doesn't run (it should run every 3-5 minutes).

There is a ticket inside them..

Greetings

A

Anonymous_User

Contributor III

This error means that FortiAuthenticator could not contact fortitokenmobile.fortinet.com to verify the status of the token. Firstly, check from FortiGate if fortitokenmobile.fortinet.com can be reached, and check also from FortiAuthenticator. Secondly, check in FortiGate if traffic versus fortitokenmobile.fortinet.com has some deep packet inspection enabled or not.

Sign up

Login with SSO

Login to the community

Login with SSO