Security

Greeting,

 

I am currently deploying a guest solution whereby guest are able to do a self-registration and the account is valid for 1 month upon approval.

 

However, we found out that when the guest already get approved and a new user use the same email as the previous guest, the old guest account will be disabled and refreshed.

 

May I know that, is there any workaround to prevent this happen?

You need to add to your enforcement policy to only allow a certain amount of devices to use the same creds
Authorization:[Endpoints Repository]:Unique-Device-Count Greater than 1 > Deny

Make sure you add the Username (Endpoint Update Profile) to the endpoint database at the time of web auth

Not sure I understand wrongly or not, when a new guest register a new account using the "already exists" email, the email in guest local account get replaced.

Cedric,

 

Go to Configuration> Guest Self-Registration.  Under Register Page, Click on Form.  On the form, you will see an field "auto_update_account".  Change the initial value to zero, and click on save.

Cant believe that this can be so easy.

 

However, if the user modify the value using "f12" in the browser, the user are able to replaced. Any idea how to prevent this?