A utility wants its guest wireless captive portal to display a legal disclaimer and require a checkbox acceptance, but explicitly does not want to issue individual guest usernames and passwords. Is this achievable with a FortiGate captive portal?

Captive portal authentication is flexible about what it demands before granting access — it can require a full username and password against a local, RADIUS, or LDAP source, or it can be configured as a disclaimer-only gate where clicking to acknowledge terms is itself sufficient to pass through, which fits a utility's goal of legal coverage without managing individual guest credentials. Claiming a username and password is always mandatory misdescribes the flexibility built into the portal's design. Disabling firewall authentication on the policy entirely would remove the interception and disclaimer step along with it, which is the opposite of what the utility wants — they still need the gate, just not a credential behind it. FSSO is an unrelated passive mechanism for domain-joined users and has no dependency relationship with captive portal; the two solve different identification problems and neither requires the other to function. A caveat worth noting: a disclaimer-only portal provides essentially no accountability for who used the network, since no individual identity is captured, which is a reasonable tradeoff for guest wifi but would be inappropriate for network segments where per-user attribution matters. Confirm the desired behavior by checking the portal's configured authentication requirement rather than assuming a fixed default.