Independent token
When Multi-Realm Mode is enabled (Settings>Global>Multi-Realm Mode), newly registered applications will be assigned to new realms. This function is very convenient for admin users who are in Managed Security Service Provider (MSSP) business.
-
FortiGate1 with serial number (FG200ETK1990xxxx) and FortiGate2 with serial number (FG300ETK1990xxxx) are registered under the same FC account.
-
As long as the realm has enough resources, FIC will automatically create two realms: FG200ETK1990xxxx-root and FG300ETK1990xxxx-root, and FGT1 and FGT2 will be assigned to those two separate realms.
-
In this case, a user created in FGT1 named “Jack Taylor” is assigned one token, and a user created in FGT2 named “Jack Taylor” is assigned another token. They are two separate users with the same username but use different tokens.
-
If the two “Jack Taylors” exist in two realms, some events could be confusing. For example, if “Jack Taylor” is deleted from FGT1, the “Jack Taylor” still exists in FIC. This scenario looks like "Jack Taylor" has never been deleted on FGT1. In fact, the “Jack Taylor” is no longer in FGT1, but only exists in FGT2.
-
Solution: Log into FGT2 and delete “Jack Taylor”. Then execute the console command
“exec fortitoken-cloud sync”in FGT. This will remove the user “Jack Taylor” in FIC. After deleting the user in FGT2, assign application FGT1 and application FGT2 to the same realm, for example, the “default” realm. This will prevent the situation from happening.