Skip to main content

Troubleshooting

The User Gets No Push​

  1. Check the provider: in the account menu (top right), open Settings → MFA Provider. Your provider should show Active.
  2. Check enrolment: the user must be enrolled in Duo Mobile or Okta Verify, with the same email address as their AuthNull account.
  3. Check the policy: the sign-in must match a policy whose action requires MFA. With Allow, no push is sent.
  4. Check the logs: Logs (Identity, RADIUS) or Access Logs (PAM) show the decision and MFA outcome for each sign-in. For Database MFA, see Database MFA Troubleshooting.

The Push Goes to the Wrong Person​

For database and PAM sessions, the push goes to the AuthNull user who opened the connection, not to the database or server account they connect as. Check which console user started the session, and that their email matches their Duo or Okta account.

A Sign-In Is Blocked Unexpectedly​

Check the tenant's mode under Settings → Tenant Configuration → Authentication policy. In Live mode, anything without an allowing policy is blocked. Switch to Audit while you build policies, then move back.

A User Cannot Sign In to the Console​

  • Forgotten password: use Forgot password? on the sign-in page.
  • Lost authenticator app: use one of the recovery codes saved when TOTP was set up.
  • Invitation expired: the page shows "This invitation has expired" - ask your administrator to invite you again.
  • "Tenant not found or inactive" (on-premises): the tenant name in the server's configuration does not match the organization. See On-Premises Troubleshooting.

Product-Specific Problems​