> For the complete documentation index, see [llms.txt](https://docs.openiam.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.openiam.com/troubleshooting/signing-in/selfservice-and-login-errors.md). # SelfService and login error messages Symptom-to-cause reference for the error messages end users see when signing in, changing passwords, using MFA, submitting requests, or using SSO. When something goes wrong on the login page, the SelfService portal, or during single sign-on, OpenIAM shows a short message but not the underlying cause. This page maps the common end-user messages to their likely cause and what to do. Most items an end user can resolve; some need a help-desk administrator. ## Sign-in errors | Symptom | Likely cause | Resolution | | ------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `Invalid Login and/or Password` | Wrong username or password. | Re-enter the credentials; use **Forgot password** / **Forgot username** if needed. | | `Login failed - Your account has been locked` | Too many failed sign-in attempts locked the account. | Wait for auto-unlock (if configured) or ask an administrator to unlock the account. | | `Login failed - Your account has been deactivated` | The account is disabled/deactivated. | The account must be reactivated by an administrator. | | `Login failed - Invalid user status: ` | The user's status does not permit sign-in (for example, pending or terminated). | Contact an administrator. | | `Login failed - Security domain is not valid` | The login request references an invalid security domain. | Check the URL you used; if it persists, the content provider/domain may be misconfigured — contact an administrator. | | `Your password has expired. Please choose a new one.` | The password expired per the password policy. | Follow the prompt to set a new password. | | `Challenge response questions feature has been disabled by your administrator` | The password policy's question-count parameters are absent, so the feature has nothing to enforce and reports itself off. Seen after a migration that did not carry them across. | An administrator confirms `QUEST_COUNT` and `CUSTOM_QUEST_COUNT` exist in `POLICY_DEF_PARAM`, with their `POLICY_ATTRIBUTE` rows marked required, then restarts `openiam-esb`. | ## Password-change errors | Symptom | Likely cause | Resolution | | ------------------------------------------------------------------------ | ------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- | | `Your login does not allow password changes` | The login (or its managed system) is not configured to permit password changes. | Contact an administrator. | | `Characters Not Allowed in Passwords` / `Words Not Allowed in Passwords` | The new password violates the password policy. | Choose a password that meets the policy (avoid the disallowed characters/words). | ## Multi-factor (OTP) errors | Symptom | Likely cause | Resolution | | --------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------- | | `Unable to send SMS message: ` | The one-time-password could not be delivered (provider, configuration, or phone number). | Verify your registered phone number and retry; if it persists, contact an administrator. | | `Unable to confirm the SMS code` | The entered OTP is wrong or has expired. | Re-enter the latest code, or request a new one. | | `HTTP 429` / `You have exceeded the maximum number of attempts` | OTP send/verify attempts exceeded the policy cap (`OTP_MAX_FAIL_ATTEMPT` / `MAX_OTP_RESEND_ALLOWED`). | Wait and try again later; contact an administrator if you are locked out. | ## Access request and approval-task errors | Symptom | Likely cause | Resolution | | ---------------------------------------------------------------------------------------- | ----------------------------------------------------------------------- | ------------------------------------------------------------------------ | | `A comment is required` | The task decision requires a comment/reason. | Enter a comment before submitting the decision. | | `This request must be claimed before a decision can be made` | You tried to decide on a group task you have not claimed. | Claim the task first, then decide. | | `Could not claim task` | The task was already claimed by another reviewer, or its state changed. | Refresh the task list — another reviewer may have taken it. | | `You do not have access to this task, or it does not exist.` | The task was reassigned, completed, or you lack permission. | Refresh your task list; contact an administrator if you expected access. | | `Could not delegate task` / `Task could not be canceled` / `Task could not be unclaimed` | The task action failed due to state or permissions. | Refresh and retry; contact an administrator if it persists. | | `Could not complete attestation request` | The certification/attestation action failed. | Retry; if it persists, contact an administrator. | ## Certification (review) errors | Symptom | Likely cause | Resolution | | ------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------- | ------------------------------------------------------------------------------ | | `This user's access cannot be approved or revoked until all SoD violations are resolved.` | Segregation-of-duties violations block the decision. | Resolve the SoD violations for that user first, then make the decision. | | `This entitlement is part of a policy that was skipped and approved for all reviewers. It cannot be revoked here.` | The entitlement is locked for this review. | It cannot be revoked from this screen; it is handled by the campaign's policy. | ## Single sign-on (SSO) errors | Symptom | Likely cause | Resolution | | ------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------- | -------------------------------------------------------------------- | | An SSO/OAuth error page showing an `error` and `error_description` | The OAuth/OIDC request failed — commonly an unregistered client or redirect URI. | Administrator: check the OAuth client configuration. | | `OAuth Client ID is not registered` | The client id is not registered in OpenIAM. | Administrator: register the OAuth client. | | `The Redirect URI for Client ID is not registered` | The redirect URI does not match a registered value. | Administrator: add the redirect URI to the client's registered list. | | `SAML Service Provider Not Found` | The SAML service provider is not configured. | Administrator: configure the SAML SP. | | `An error occurred while logging into the service provider. Please contact your system administrator.` | A general SAML SP login error. | Contact an administrator. | ## Customizing the error pages The generic error page and the SSO error page can be customized (branding and message text) with a Groovy error-page display handler. See [External links on login page](/administration-guide/platform/system-configuration.md) for the handler examples. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.openiam.com/troubleshooting/signing-in/selfservice-and-login-errors.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.