> For the complete documentation index, see [llms.txt](https://docs.openiam.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.openiam.com/administration-guide/faq.md). # Frequently asked questions The questions administrators ask most often, answered briefly and linked to the page that carries the detail. ## What this is, and when you need it This section is for the administrator who has a question in their own words rather than an outcome to configure. Every entry answers one question in a few sentences and links to the page that owns the detail, grouped into five areas. Use the [Error and symptom index](/administration-guide/error-and-symptom-index.md) instead when you have an exact message to match, and a section hub when you already know the outcome you want. ## Choose your outcome | I want to… | Go to | | ------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------ | | Look up an exact error message, log line or UI message | [Error and symptom index](/administration-guide/error-and-symptom-index.md) | | Work out why one named person cannot sign in | [A user cannot sign in](/administration-guide/security/cannot-sign-in.md) | | Work out what still has to happen when somebody leaves | [Offboard a leaver end to end](/administration-guide/lifecycle/offboard-a-leaver.md) | | Ask why a request through the Access Gateway returns 404, loses the SAML request, or lands on the wrong page | [Gateway, SSO and federation](/administration-guide/faq/gateway-and-federation.md) | | Ask about SAML assertion encryption, certificate sign-in, relay state, or a different authentication level per federation | [Gateway, SSO and federation](/administration-guide/faq/gateway-and-federation.md) | | Ask whether an application with only a login form can have single sign-on — form fill, credential injection, password vaulting | [Gateway, SSO and federation](/administration-guide/faq/gateway-and-federation.md) | | Ask whether users can sign in without a password at all | [Gateway, SSO and federation](/administration-guide/faq/gateway-and-federation.md) | | Ask about a custom field, a page template, or a SelfService profile page that came back blank | [Identities, roles and scheduled work](/administration-guide/faq/identities-and-access.md) | | Ask about orphan accounts, unlinking and re-linking an identity, or a role change that produced no audit event | [Identities, roles and scheduled work](/administration-guide/faq/identities-and-access.md) | | Ask why every batch task stopped at once, or whether one can produce a CSV on a schedule | [Identities, roles and scheduled work](/administration-guide/faq/identities-and-access.md) | | Ask about an approval step that never ran, a revoke that changed nothing, or requests that still go to `sysadmin` | [Operations, requests and access](/administration-guide/faq/operations-and-requests.md) | | Ask about a missing **Save** button, a menu item that will not hide, or a read-only administrator role | [Operations, requests and access](/administration-guide/faq/operations-and-requests.md) | | Ask about a bulk operation that loops, one user's screen loading slowly, or a broker acknowledgement timeout | [Operations, requests and access](/administration-guide/faq/operations-and-requests.md) | | Ask why a policy-map value, an enable or disable, or a pre-processor change never reaches the target | [Provisioning and lifecycle](/administration-guide/faq/provisioning-and-lifecycle.md) | | Ask about `ANOTHER_SAVE_IN_PROGRESS`, or two users' data mixing under concurrent provisioning | [Provisioning and lifecycle](/administration-guide/faq/provisioning-and-lifecycle.md) | | Ask about forgot-password, activation link validity, reset methods, or the help-desk verification questions | [Security, recovery and platform](/administration-guide/faq/security-and-platform.md) | | Ask why recovery or one-time-password mail never arrives when the test message does | [Security, recovery and platform](/administration-guide/faq/security-and-platform.md) | | Ask about privilege escalation by entitlement operators, or a group renamed in Active Directory | [Security, recovery and platform](/administration-guide/faq/security-and-platform.md) | | Find the section that owns the outcome I want instead | [Administration Guide](/administration-guide/admin.md) | *Applies to OpenIAM 2026.8.1. Last reviewed 7 August 2026.* --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.openiam.com/administration-guide/faq.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.