Identity troubleshooting

Each entry names a symptom, its cause and what to do. Message ids link to the entry in the error codes.

Sign-in refused

Cause. Kyvernon gives one answer, error.auth.invalid_credentials, for every reason: the user does not exist, the password is wrong, the account is disabled or locked, or the sign-in policy refused the account. After ten failed attempts within 15 minutes the account is locked for 15 minutes. The console then says how long to wait.

Remedy.

1. Check the user name and the password.
2. An administrator reads the account with kyvernon users get <username>: enabled, locked and lockedUntil.
3. Enable the account with kyvernon users enable <username>, or lift the lockout with kyvernon users unlock <username>.
4. The audit log holds the real reason: kyvernon audit list.

Too many attempts

Cause. One address, or one user name from one address, has failed several times, and Kyvernon delays further attempts (error.auth.rate_limited). The delay grows up to 15 minutes. Users behind one proxy share the address that the controller sees.

Remedy. Wait for the time in the message. When users share a proxy, an administrator lists the proxy in trusted_proxies in the section [http] of the controller configuration so that the real client address is used.

Verification code not accepted

Cause. The code has expired or was used already, or the clock of the phone is out of step (error.auth.invalid_code). The sign-in can also have waited too long for the code (error.auth.mfa_expired): the first step is valid for 5 minutes.

Remedy.

1. Wait for the next code and enter it. Check the clock of the phone.
2. Use a recovery code when the phone is lost. Each one works once.
3. An administrator removes the enrolment with kyvernon users reset-mfa <username> when the phone and the codes are lost. The user sets up verification again at the next sign-in.

Session ended

Cause. The session reached its lifetime, was idle for 15 minutes, or was ended by an administrator (error.auth.session_expired). A refresh token that is used twice ends the whole session as a precaution (error.auth.refresh_reuse).

Remedy. Sign in again; the console keeps the unsaved work of the page. When sessions end earlier than the settings say, an administrator reads kyvernon sessions list and the audit log, and checks session_idle in Sign-in security.

Permission denied

Cause. The user lacks a privilege on the object (error.permission_denied). The reasons are: no permission on the object or above it, a role without the privilege, a permission with the role No access on a child that overrides a grant higher up, a permission that does not propagate, or a tenant user outside the folders of the tenant.

Remedy.

1. Find the privilege in the reference: Privileges.
2. Check it for the signed-in user: kyvernon privileges check <entity> <privilege>.
3. Read the permissions of the object and of its parents: kyvernon permissions list <entity>, or the tab Permissions.
4. Give a role that holds the privilege, see Roles and permissions.

Object not found

Cause. The object does not exist, or the user may not see it. Kyvernon answers both cases with error.not_found, so that the answer does not reveal what exists.

Remedy. Check the id. When the object exists, ask an administrator for a role that grants System.View on it.

Request rejected as a conflict

Cause. The request used an old version of the object (error.conflict), or the name exists already (error.already_exists). A federated user whose name equals a local user is refused for the same reason.

Remedy. Read the object again and repeat the change with its current version, or choose another name.

Sign-in with the provider fails

Cause. The provider refused or did not answer, the sign-in took longer than the validity of the login (10 minutes), or the provider sent no usable user name. The console says that sign-in with the organisation did not complete.

Remedy. Try again or use a local account. An administrator checks kyvernon auth config, the issuer, the client secret file and the redirect address in the section [oidc]. See Single sign-on.

Automation refused

Cause. The token has expired or was revoked, the user is disabled, or the endpoint does not accept the password of the account (error.unauthenticated). On the vSphere endpoints the setting facade_login can allow tokens only.

Remedy. Create a new token with kyvernon auth api-tokens create <name>; see API tokens. Pass the token as --token-file or in the password field.

Related

• Sign-in security
• Sessions and audit