Fortinet black logo

Admin Guide

A single FTC user in multiple auth clients

Copy Link
Copy Doc ID 0a6c5280-a080-11ee-8673-fa163e15d75b:625594
Download PDF

A single FTC user in multiple auth clients

A given FTC user can be in two or more auth clients (FGT or FAC devices), resulting in the so-called "a-single-user-in-multiple-auth-clients" situation. For example, User-1 can be in FGT-1 and FGT-2. An FTC admin user is able to see all auth clients (FGTs) for a given user on the FTC portal.

You must keep the following two important points in mind when handling such a situation:

(1) When you disable (remove) User-1 from FGT-1, it still exists in FGT-2. As a result, User-1 still remains in FTC. The only way to remove User-1 from FTC is to remove it from both FGT-1 and FGT-2.

(2) Suppose you have enabled User-1 for FTC in FGT-1 and FGT-2, and User-1 has a token from FTC. You disable User-1 in FGT-1, but leave it still enabled in FGT-2 so that it still exists in FTC. Later on, if you enable User-1 again without assigning it a new FTC token, User-1 will continue to use the same FTC token that it has used before.

Now suppose, instead of enabling User-1 again in FGT-1, you assign SMS from FGT-1 (an FGT internal feature that is not available in FTC) as the MFA method for User-1. This is what is going to happen: If User-1 attempts to log into FGT-1, the user will get an SMS from FGT-1; but if User-1 attempts to log into FGT-2, the user will have to use the FTC token.

Note

Starting with its version 20.1.a release, FortiToken Cloud has introduced the multi-realm concept. As a result, two identical end-users can co-exist on two different auth clients assigned to two different realms.

A single FTC user in multiple auth clients

A given FTC user can be in two or more auth clients (FGT or FAC devices), resulting in the so-called "a-single-user-in-multiple-auth-clients" situation. For example, User-1 can be in FGT-1 and FGT-2. An FTC admin user is able to see all auth clients (FGTs) for a given user on the FTC portal.

You must keep the following two important points in mind when handling such a situation:

(1) When you disable (remove) User-1 from FGT-1, it still exists in FGT-2. As a result, User-1 still remains in FTC. The only way to remove User-1 from FTC is to remove it from both FGT-1 and FGT-2.

(2) Suppose you have enabled User-1 for FTC in FGT-1 and FGT-2, and User-1 has a token from FTC. You disable User-1 in FGT-1, but leave it still enabled in FGT-2 so that it still exists in FTC. Later on, if you enable User-1 again without assigning it a new FTC token, User-1 will continue to use the same FTC token that it has used before.

Now suppose, instead of enabling User-1 again in FGT-1, you assign SMS from FGT-1 (an FGT internal feature that is not available in FTC) as the MFA method for User-1. This is what is going to happen: If User-1 attempts to log into FGT-1, the user will get an SMS from FGT-1; but if User-1 attempts to log into FGT-2, the user will have to use the FTC token.

Note

Starting with its version 20.1.a release, FortiToken Cloud has introduced the multi-realm concept. As a result, two identical end-users can co-exist on two different auth clients assigned to two different realms.