Troubleshooting
Diagnose sign-in, password-policy, directory, reset, and logout-page issues without exposing sensitive data.
Troubleshooting
Section titled “Troubleshooting”Use this section when a Password Reset sign-in, reset, or completion page does not behave as expected. Start with the product version, trace identifier, and CEF events.
| Symptom | Checks |
|---|---|
| Repeated login redirect or unauthorized API response | Verify the public URL, AuthN SP/IdP configuration, session handling, and reverse-proxy settings. |
| Reset rejected before the pipe | Verify authenticated-session and XSRF handling. Do not disable either protection to work around the error. |
| Unexpected password requirements | Check password_policy in the trusted session and the configured default policy. Do not configure rules and rule_policies together. |
| Password accepted by the UI but rejected by the directory | Compare the UI rules with directory history, complexity, and time restrictions. See the reset integration's sanitized error. |
| AD connection fails | Verify network reachability, LDAPS certificate trust, connection credentials, and delegated permissions. Keep certificate validation enabled. |
| Success message but no directory change | Check that the chosen pipe contains a real reset valve and verify a new sign-in with the synthetic target account. An empty pipe is not a reset implementation. |
| Logout page ignores branding | Verify logout_endpoint_url, the bundled UI version, and customer overlay paths. See Upgrade. |
If more detail is necessary, follow Extended logging with synthetic data. Never attach complete requests, sessions, or tokens to a support case.
In this section