Fully patched Portal Access, working in one profile, does not work in another, almost identical profile.

Client has a APM portal working just fine: the classical configuration, webmail, a couple of internal services, network access. That works a wonder.

Now they want a separated profile, just for webmail, kind of a "captive portal". For this, we copied the other profile, removed the unnecessary parts, and what happens is that the SAME portal access (fully patching) does not work. At first I thought I missed the SSO mapping, etc., but then we added, as a test, another portal access (minimally patched) to the resource assignment, and started working. Absolutely no idea what is happening here, if we take out that portal access it stops working.

The fully patched is a fully patched with all checks checked.