Troubleshooting
Known problems with an on-premises deployment, by symptom. Commands run on the server.
Sign-in
The sign-in page shows domainUrl=<IP address>
Bare-IP mode only. The Admin UI sends the browser's address to the sign-in page instead of DOMAIN_URL, and the backend cannot find the organization.
Make sure the live Nginx file contains the patch from nginx/nginx-ip.conf:
sudo grep -n 'static/js/main' /etc/nginx/nginx.conf
If nothing is printed, copy the template again (sudo cp nginx/nginx-ip.conf /etc/nginx/nginx.conf), reload Nginx, and reload the page with the browser cache cleared.
Sign-in fails with "Tenant not found or inactive"
The tenant was stored under a different name from the one sign-in looks up. Check that, in .env, DOMAIN_URL is default.<ORG_NAME>.<domain> and TENANT_BASE_DOMAIN is that same <domain>. Then compare with the tenant AuthNull stored:
docker exec -it $(docker ps --format '{{.Names}}' | grep -i postgres) sh -c 'psql -U "$POSTGRES_USER" -d customer-org-name -c "select id, site_url, status from did.tenants;"'
site_url must equal DOMAIN_URL exactly. If it does not, fix .env and run docker compose up -d; for an organization that already exists, update site_url to match DOMAIN_URL.
Changes to nginx/*.conf have no effect
Nginx reads only /etc/nginx/nginx.conf. Confirm which file is live with sudo nginx -T | head -3, copy the template there, then sudo nginx -t && sudo systemctl reload nginx.
Database Logins
Problems with ProxySQL, the database agent, or database logins are covered in Database MFA Troubleshooting.
Useful Logs
| Component | Command |
|---|---|
| Backend | docker compose logs -f authnull-service |
| authn-service (MFA decisions) | docker compose logs -f authn-service |
| Database agent | sudo tail -f /var/log/authnull-db-agent.log |
| ProxySQL | sudo tail -f /var/lib/proxysql/proxysql.log |
| Nginx | sudo tail -f /var/log/nginx/error.log |