FortiAuthenticator user disable before approve process

[Fabio]

Hello, 

 I have a problem with disabling usernames that register on the Captive Portal create on my FortiAuthenticator.
After the registration but before approval by an Administrator, if the user tries to authenticate with the credentials they registered with, the FortiAuth disables the user and the link that comes (with email) to Administrator or sponsor generates an error and cannot be approved.
I have to go into management and reenable the user manualy.
Any ideas to avoid this?

Thank's

[Fabio]

[ebilcari]

I'm not sure but this may fall to the Lockouts policy, can you check what value is configured here:

[Fabio]

yes i have lockout policy but they have attempt 10 times

I don't think this is the problem because the lockeout timeout then after 60 seconds ends but in my case it remains disabled.

[Fabio]

 i open a TAC

[Fabio]

I tried to disable User Lockout Policy and the issue was not happened again.

Here is the Captive Portal locked screen when the user try to connect before the approval.

I hoper to find a bug that will be recovered with new release.

[ebilcari]

Thanks for sharing your findings. Since the behavior is easy reproducible I think the engineering team will identify it and offer a solution in the next release. You have to follow up with the TAC support team.

[dbu]

Hi @Fabio ,
I think this behavior can be expected because user is still not active for use until the sponsor's approval is done. It makes sense also that link of the approval is not working anymore because that user is already disabled. 

[Fabio · Accepted solution]

Fortinet support acknowledged it was a Bug and that it will be fixed in the next releas of FAC 6.6.1 GA.