Cause. The sign-in was refused. Kyvernon gives the same answer for every reason: the user name does not exist, the password is wrong, the account is locked or disabled, or the sign-in policy of the controller refused it. The answer does not say which reason applied, so that it cannot be used to find out which accounts exist.
Remedy.
Check the user name and the password, then sign in again.
After repeated failures the account is locked for a time. An administrator reads the state with kyvernon users get <username> (the fields locked and lockedUntil) and lifts the lock with kyvernon users unlock <username>.
When the account is disabled, an administrator enables it with kyvernon users enable <username>.
When the problem remains, give an administrator the time of the attempt. The audit log holds the real reason.
error.auth.rate_limited
Text in the console
Too many sign-in attempts. Try again in {retryAfterSeconds} seconds.
Cause. Too many failed attempts came from the same address, or for the same user name from the same address, within 15 minutes. Kyvernon slows such attempts down with a delay that grows with each failure, up to 15 minutes. IPv6 addresses count per /64 prefix. The answer carries the header Retry-After.
Remedy.
Wait the number of seconds shown in the message, then sign in again.
Do not repeat the attempt before then: an attempt during the delay is refused.
When several users share one address behind a proxy, an administrator checks that the proxy is listed in trusted_proxies in the [http] section of the controller configuration, so that Kyvernon sees the real client address.
error.auth.invalid_code
Text in the console
The code was not accepted. It may have expired or been used already. Wait for the next code and try again.
Cause. The six-digit code or the recovery code was not accepted. The code has expired, was entered already, or comes from an authenticator app whose clock is out of step. A recovery code works once. Wrong codes are slowed down in the same way as wrong passwords.
Remedy.
Wait for the next code in the authenticator app and enter it.
Check that the clock of the device that runs the app is correct.
When the device is lost, use one of the recovery codes shown when two-step verification was set up.
When no recovery code is left, an administrator removes the enrolment with kyvernon users reset-mfa <username>. The user then sets up two-step verification again.
error.auth.mfa_expired
Text in the console
The sign-in took too long and was cancelled. Sign in again.
Cause. The first step of the sign-in (the password) succeeded, but the second step did not arrive in time, or the pending sign-in is unknown or was used already.
Remedy.
Sign in again with the user name and the password.
Enter the verification code without delay.
With the CLI, give the code in the same command: kyvernon login <username> --code <code>.
error.auth.mfa_proof
Text in the console
The verification does not belong to this sign-in. Sign in again.
Cause. The request to complete two-step verification did not carry exactly one of code and recoveryCode. The console never sends such a request, so this appears with API clients and scripts.
Remedy.
Send either code (the six-digit code) or recoveryCode in the request, not both and not neither.
Sign in again to get a new pending sign-in, then repeat the request.
error.auth.access_expired
Text in the console
Your access expired. The session is being renewed; try again.
Cause. The short-lived access of the browser session ended. The console renews it with the refresh cookie and repeats the request, so people rarely see this message.
Remedy.
Repeat the action. The console has renewed the session by then.
When the message returns every time, the cookies of the site may be blocked or removed. Allow cookies for the address of the console and sign in again.
error.auth.session_expired
Text in the console
Your session ended. Sign in again.
Meaning for API clients
The refresh token or session expired; log in again.
Cause. The session ended: it reached its lifetime, was idle for longer than the idle timeout, was revoked by an administrator, or the refresh cookie is missing or no longer valid.
Remedy.
Sign in again. The console keeps the unsaved work of the page and offers to continue after sign-in.
When sessions end sooner than expected, an administrator reads the idle timeout (session_idle) in the [identity.policy] section of the controller configuration and the list of active sessions with kyvernon sessions list.
error.auth.refresh_reuse
Text in the console
Your session was ended because a sign-in token was presented twice. Sign in again; if this repeats, tell an administrator.
Meaning for API clients
A refresh token was presented twice; the session family is revoked.
Cause. The refresh token of the session was presented a second time. This can mean that a copy of the token was stolen and used. Kyvernon ends the whole session family as a precaution and records the event.
Remedy.
Sign in again.
When it repeats, change the password of the account and tell an administrator. Give the time of the first message. The administrator reads the audit records with kyvernon audit list and can end every session of the user with kyvernon users revoke-sessions <username>.
error.auth.refresh_race
Text in the console
Another tab renewed the session at the same moment. Try again.
Cause. The header X-Kyvernon-CSRF of a request that changes data is missing or does not equal the cookie kyvernon_csrf. This protects a signed-in browser against requests from other sites.
Remedy.
Reload the page, then repeat the action.
When the message stays, sign in again. The cookie may have been removed.
Developers who call the API from their own web page send the value of the cookie kyvernon_csrf in the header X-Kyvernon-CSRF.
error.auth.origin
Text in the console
The request came from an address this server does not accept. Open the interface at its published address.
Cause. The Origin header of the request, or the Sec-Fetch-Site mark of the browser, shows that the request comes from a web page at an address that the controller does not accept. Kyvernon accepts the address of the controller itself (https://<host>) and the addresses listed in allowed_origins in the [http] section of the controller configuration.
Remedy.
Open the console at the address that the administrator published, not through an alias, an IP address or an older bookmark.
When the console is served from another address on purpose, an administrator adds that address to allowed_origins and restarts the controller. Pass on the message id error.auth.origin and the address you opened.