This page helps when a person cannot sign in to Hermetry or cannot open their organisation after signing in. It is written for members and for the administrators who help them. Device logins are a different topic: see A device does not connect.
Password and lockout
| Message or symptom | Cause | Fix |
|---|---|---|
| The password is not accepted | A typo, caps lock, or the account uses another sign-in method (passkey, single sign-on) | Use Forgot your password? on the sign-in page to get a reset link by e-mail |
| “This account is locked after too many failed sign-ins. Try again later or reset your password.” | Too many wrong passwords: 5 by default (an organisation may set 1 to 5 under Settings > Authentication & SSO) | Wait (15 minutes by default) or reset the password |
| A CAPTCHA appears | A few failures in a row where a CAPTCHA provider is installed | Complete it |
| “This account is locked for security reasons. Every sign-in method is blocked until it is unlocked. Contact support.” | Hermetry’s operators put a security lock on the account | Contact support; the person is told by e-mail |
The lock is checked before the password, so a locked account gives no hint whether the password was right. Every lock is written to the audit log (auth.account_locked). See Sessions, lockout and trusted devices.
The second step
| Message | Cause | Fix |
|---|---|---|
| “That code did not work. Try again.” / “That code is not correct. Check it and try again.” | A wrong code | For an authenticator app, check the phone’s clock is set automatically |
| “This code has expired. Send a new one.” | E-mail and SMS codes are short-lived | Select Send code again |
| “Too many wrong codes. Please wait a few minutes and try again.” / “Too many wrong codes. Verification codes are paused for n minutes.” | Repeated wrong codes | Wait |
| “This organization requires two-step verification. Sign in again and complete it.” | The organisation requires a second factor and this session has none | Add a passkey on My Profile > Passkeys, then sign in again with it |
| A member cannot open the organisation after the owner required two-step verification | Members without a second factor cannot open the workspace until they add one | They sign in, add a passkey, and sign in again with it |
Setting up an authenticator app, e-mail codes or SMS codes from My Profile is in development; a passkey is the second factor every member can add today. See Two-factor sign-in and passkeys.
Lost the device with the passkey
Sign in with another registered passkey (a backup passkey on another device or a hardware key). Without one, ask an administrator of your organisation for help; this is why every member should register a backup passkey.
Trusted browser asks again
A trusted browser skips the second factor for at most 30 days. After that, or after Revoke all on My Profile > Security, the next sign-in asks for the second step again.
Single sign-on (SAML)
Single sign-on for an organisation uses SAML 2.0. Connecting your own OpenID Connect provider as the organisation’s single sign-on is not available.
| Symptom | Cause | Fix |
|---|---|---|
| “SAML sign-in is off for this connection: its signature settings are too weak…” | The connection was stored with SHA-1 or unsigned assertions | Use SHA-256 or SHA-512 signed assertions and save the connection again |
| The provider’s response is refused | The assertion is not signed, its audience or ACS URL does not match, or the clocks differ by more than a few seconds | Compare Entity ID (Audience URI) and ACS URL (Reply URL) with your provider; fix the provider’s clock |
| A replayed assertion is refused | Assertion Replay Detection is on | Start a new sign-in |
| A sign-in started from the provider’s portal fails | Allow IdP-initiated SSO is off (the safer default) | Start from Hermetry’s sign-in page, or turn the option on |
| A new person cannot sign in with SSO | Enable Just-In-Time provisioning is off, so only existing members can sign in with SSO | Invite them, or turn on just-in-time provisioning |
| An existing member gets a new, empty account | The e-mail in the assertion differs from the member’s account e-mail | An account is linked only when the e-mails match. Fix the Email Attribute mapping. |
| Nobody can sign in after SAML was turned on | The connection was not tested | Always test in a second browser before you sign out of the first. If everyone is locked out, contact support. |
SAML is configured by an Owner. See Single sign-on.
The wrong organisation or address
| Symptom | Cause | Fix |
|---|---|---|
| You sign in but see another organisation, or none | One account can belong to several organisations | After signing in on the platform’s main address, pick the organisation in the organisation picker; Go to my organizations returns to it |
| “Not found” or an unknown page at your organisation’s address | A typo in the address (<address>.<platform domain>), or the custom domain is not set up | Use the free address, which always works. See Web addresses and custom domains. |
| You signed up in the wrong region | Each organisation lives in one home region | The home region cannot be changed by yourself: contact support |
| “This workspace is read-only while it is being moved. Please try again later.” | The organisation is being moved | Reading works; wait and try changes later |
Membership and access
| Symptom | Cause | Fix |
|---|---|---|
| The invitation link does not work | It expired (7 days by default, or shorter by the organisation’s setting), was revoked or replaced by a newer invitation | Ask for a new invitation |
| The invitation is not offered after you sign in | You signed in with another e-mail address than the one invited | Sign in or sign up with the invited address |
| You can sign in but have no access to the organisation | Your membership is Suspended or was removed | Ask an administrator |
| You were signed out everywhere | An administrator used Sign out, your role changed, or you were suspended | Sign in again; if refused, ask an administrator |
403 with TENANT_IP_NOT_ALLOWED after sign-in | The organisation’s IP access lists refuse your address | Connect from an allowed network, or ask an owner to add your address |
| New accounts cannot register | Allow Public Registration is off | Ask an administrator for an invitation |
| You must verify your e-mail first | Require Email Verification is on | Open the verification mail |
See Users and roles and Invite your team.
Unusual sign-in notices
If you get a notice or your administrator sees auth.login_anomaly for your sign-in, Hermetry flagged it as unusual: impossible travel, a new country, an anonymising network, a new address or a new browser. It is not a block. If it was not you, change your password, sign out all other sessions under My Profile > Security > Active Sessions, and tell your administrator.