Skip to main content

Authentication Troubleshooting

Use this page when a user, administrator, or integration owner reports that they cannot sign in, cannot reach the right tenant, cannot see the expected product area, or receives authentication errors from an integration.

Start by separating authentication from authorization. Authentication answers whether the identity is accepted. Authorization answers whether the accepted identity can perform the requested task.

Prerequisites​

Before changing roles or resetting credentials, confirm the environment, affected identity, sign-in method, and exact failed task. Avoid changing multiple access layers at once, because it makes the root cause harder to prove.

Triage flow​

Inputs​

EvidenceWhy it matters
User identityConfirms the exact account, email, user claim, or service identity.
Environment URLPrevents mixing production, staging, private cloud, or on-premises deployments.
Timestamp and timezoneLets administrators compare FactVerse logs and IdP logs.
Sign-in methodPassword login, enterprise SSO, client login, API key, or service account.
Error text or screenshotHelps distinguish account, redirect, tenant, package, or product permission problems.
Browser or client versionLogin behavior can depend on embedded browser, redirect handling, cookie policy, or client version.
First failed taskShows whether the issue is login, tenant access, navigation, or a product permission.

Common symptoms​

SymptomFirst checks
Login page does not loadEnvironment URL, network route, DNS, VPN, proxy, firewall, or service availability.
Password login failsAccount status, password reset state, tenant policy, and whether SSO is required.
SSO redirect loopsCallback URL, browser cookie policy, IdP app assignment, domain mismatch, or blocked embedded web view.
SSO succeeds but user is unknownUser identifier claim, account provisioning, tenant membership, or user mapping.
User can sign in but sees no tenantTenant membership, project assignment, invited account status, or wrong environment.
Product area is hiddenRole package, product entitlement, navigation permission, or project scope.
API call returns unauthorizedAPI key value, endpoint slice, key scope, environment URL, header name, or key revocation.
AI workflow cannot access contentWorkflow identity, service account scope, product permission, folder rule, dataset scope, or document classification.

Troubleshooting steps​

  1. Confirm the environment URL and whether the issue happens in web, desktop, mobile, or API access.
  2. Confirm the identity and sign-in method.
  3. Test with a known working account in the same environment when allowed by the support process.
  4. Compare the user against the expected tenant, project, role, and product package.
  5. For SSO, collect the IdP application assignment, redirect timestamp, and visible error.
  6. For API keys, confirm the key is active, scoped for the endpoint, and sent in the expected header.
  7. For product task failures, open the product-specific permission page and check object-level access.

Validation​

After applying a fix, repeat the smallest task that originally failed. Record the user or service identity, environment, timestamp, result, and the access layer that changed. If SSO or API key settings changed, validate both a successful identity and an identity that should remain blocked.

Expected result​

The issue is ready to close when the identity can authenticate through the intended method, reach the correct tenant, see only the expected product areas, and complete the target task. The final note should state whether the root cause was account status, SSO, tenant membership, role package, product permission, object scope, session state, or API key scope.

Escalation package​

When escalating to the DataMesh or customer IT team, include:

  • environment URL;
  • user or service identity;
  • sign-in method;
  • exact timestamp with timezone;
  • failed URL or API endpoint;
  • error message or screenshot;
  • expected tenant, project, product, and task;
  • recent access changes, role changes, SSO changes, certificate rotation, or key rotation.