Troubleshoot authentication

Authentication issues in automation orchestrator can involve login failures, missing permissions, expired sessions, or identity provider configuration problems.

Cannot log in as an administrator

Symptom: No administrators can log in.

Resolution: If no administrators can log in, use the orchestrator-admin CLI from inside the application pod. For steps, see Recover access with the orchestrator-admin CLI.

Cannot log in as a user

Symptom: A user cannot login.

Resolution: Re-enable the user account with the orchestrator-admin CLI. For steps, see Recover access with the orchestrator-admin CLI.

Cannot log in with the built-in administrator account

Symptom: Authentication fails or the Sign in using local account link does not appear.

Resolution:

  • Verify you have the correct username and password. The credentials are generated during deployment.
  • If the Sign in using local account link does not appear, the account may be disabled. Re-enable it using the recovery procedure.
  • Contact your platform administrator to verify whether credentials were rotated.
  • To reset the built-in administrator password, see Recover access with the orchestrator-admin CLI.

Cannot log in with an external identity provider

Symptom: Login fails when authenticating through an external identity provider. The login page may display an "Authentication failed" alert.

Resolution:

  • Verify you have a valid, active account with the identity provider.
  • Navigate directly to the identity provider URL to confirm it is accessible.
  • Ensure browser cookies are enabled for both automation orchestrator and the identity provider domains.
  • Complete all required multi-factor authentication steps.
  • Contact your administrator to verify the OIDC configuration. Use the Test connection button in the provider form to verify connectivity.

User provisioned but has no access

Symptom: User can log in but cannot access resources or receives 403 errors.

Resolution:

  • Check the user's group memberships by going to their profile page in the UI.
  • Verify that group mappings are configured correctly for the identity provider.
  • For Ansible Automation Platform, verify that the group extraction expression matches your team and organization structure.
  • For generic OIDC, verify that the identity provider is sending group claims in the expected format.
  • Contact your administrator to verify policy grants for your role and groups. For more information, see Control access with predefined roles.

Groups not assigned correctly

Symptom: Group memberships in automation orchestrator do not match the identity provider.

Resolution:

  • Use Discover groups in the Group Mapping tab to view the raw token claims and extracted groups.
  • Verify the Group Extraction Expression matches your identity provider's claim structure.
  • If Allow all authenticated is disabled, verify the target groups exist in automation orchestrator and that explicit group mappings are configured.
  • Check the explicit group mapping entries for correctness.
  • For Ansible Automation Platform, verify the aap_teams and aap_organizations claims are present in the token. The default expression expects teams formatted as {organization, name} objects.

Session expires unexpectedly

Symptom: User is logged out before the expected 8-hour session timeout.

Resolution:

  • Check with your administrator if sessions were revoked intentionally.
  • Verify browser cookies are not being automatically cleared (the ao_refresh_token HttpOnly cookie is required for session refresh).
  • Log in again to start a new session.

Identity provider is unavailable

Symptom: Cannot log in because the identity provider is unreachable.

Resolution:

  • Active session: You can continue working for up to 8 hours. The session does not depend on the identity provider.
  • No active session: Wait for the identity provider to be restored, or contact your administrator to re-enable the built-in administrator account.

Session store is unavailable

Symptom: Authentication endpoints return 503 Service Unavailable errors. Login, token refresh, and logout fail.

Resolution:

  • Verify that the PostgreSQL database is running and accessible from automation orchestrator.
  • Check database connectivity and credentials in the automation orchestrator deployment configuration.
  • Active access tokens remain valid until they expire (up to 15 minutes), but no new sessions can be created until the database is restored.

User account disabled unexpectedly

Symptom: User receives a 401 ACCOUNT_DISABLED error when making API requests.

Resolution:

  • Check with your administrator if the account was intentionally disabled.
  • An administrator can re-enable the account using PATCH /api/v1/users/{user_id} with {"is_enabled": true}.
  • If no administrators can log in, see Recover access with the orchestrator-admin CLI.

Login denied: user not authorized

Symptom: Identity provider login fails because the user does not match any group mapping and Allow all authenticated is not enabled.

Resolution:

The login page displays the following message: "Access denied. Your identity provider groups do not match any configured group mappings. Contact your administrator."

The backend redirects the user to the login page with the ?auth_error=no_group_match query parameter.

To resolve this:

  • Enable Allow all authenticated on the identity provider to allow all users to log in regardless of group mapping results.
  • Alternatively, configure explicit group mappings to map the user's identity provider groups to automation orchestrator groups.

Local login is disabled

Symptom: Non-admin local users cannot log in. The login form accepts credentials but authentication fails.

Resolution:

  • Check whether the Local login setting is disabled in Settings > Authentication.
  • If local login is disabled, only the built-in administrator account can use password authentication.
  • Re-enable the setting if local users need password access, or configure an identity provider for those users.

OIDC token validation fails

Symptom: Login fails with a token validation error displayed on the login page.

Resolution:

  • Verify the OIDC provider configuration matches your provider's settings (issuer URL, client ID).
  • Check for clock skew between automation orchestrator and the identity provider.
  • Verify TLS certificates are valid and not expired.
  • Use the Test connection button to verify the OIDC discovery document is accessible.