Skip to main content

Symptom

User reports one or more of the following:

  • Login fails.
  • SSO sign-in fails.
  • Role is not assigned correctly.
  • Permission denied when performing expected action.

Diagnosis steps

  1. Confirm user identity, email, and workspace.
  2. Check current role assignment in admin console.
  3. Verify SSO configuration and recent identity provider changes.
  4. Reproduce denied action with role matrix reference.
  5. Check if issue is isolated to one user or group.

Root cause

  • User not provisioned in target workspace.
  • Role missing or incorrectly assigned.
  • SSO claim mismatch or expired session.
  • Permission policy not aligned with required action.

Resolution

Login or SSO failure​

  1. Confirm user account is active.
  2. Ask user to re-authenticate and clear stale session.
  3. Validate SSO claims mapping for required attributes.

Role not assigned​

  1. Assign correct role based on task requirements.
  2. Ask user to sign out and sign in again.
  3. Confirm updated role appears in user profile.

Permission denied​

  1. Compare requested action against role matrix.
  2. If expected, update role assignment.
  3. Re-test action and confirm success.

Escalation

Escalate when:

  • SSO errors persist after claim and session validation.
  • Role updates do not propagate.
  • Permission denial impacts multiple users unexpectedly.

Escalate to:

  • L2 Support for identity and policy diagnostics.
  • Engineering for authorization service defects.

Include:

  • Workspace ID, user ID, role assignment history.
  • SSO provider logs and timestamp.
  • Exact denied action and error text.

Related issues