Red Hat Summit Red Hat SummitSupportConsoleDevelopersStart a trialContact

Chapter 8. Troubleshoot authentication issues

Learn how to troubleshoot common authentication issues.

8.1. Reduce the size of issued tokens
Copy link

If user identity tokens grow large and cause HTTP errors, you can use the omitIdentityTokenOwnershipClaim flag to remove the ent claim from the JWT payload and reduce token size.

Procedure

  • In the app-config.yaml file, set omitIdentityTokenOwnershipClaim to true as follows: 

    auth:
  omitIdentityTokenOwnershipClaim: true

8.2. Troubleshoot unexpected session expiration
Copy link

If sessions expire sooner than expected, check the following settings. The mechanism with the shortest timeout takes effect first.

Procedure

  1. Check the Identity Provider (IdP) session timeout: the IdP might have a shorter session lifetime than Developer Hub.
  2. Check the sessionDuration parameter for your authentication provider.
  3. Check the AutoLogout idleTimeoutMinutes setting, if auto-logout is enabled.

If users receive no warning before their session expires, auto-logout might not be enabled. Without auto-logout, sessions expire silently based on sessionDuration or IdP settings.

Procedure

  • To enable pre-expiration warnings, configure the auth.autologout settings in your app-config.yaml file.

If users are not redirected to the login page after their session expires, verify the following.

Procedure

  1. Verify that your Developer Hub version includes the upstream session expiration fix.
  2. Verify that your authentication provider is correctly configured with valid metadataUrl, clientId, and clientSecret settings.

8.5. Troubleshoot login failed errors
Copy link

When a user cannot sign in to Developer Hub, the sign-in page displays a "Login failed" error message. The following sections describe common login errors and their solutions. 

Login failed; caused by Error: Failed to sign-in, unable to resolve user identity. Please verify that your catalog contains the expected User entities that would match your configured sign-in resolver.

This error indicates that the user signing in does not match a user entity in the Developer Hub software catalog.

To resolve this issue:

  1. Check that the corresponding catalog provider plugin is set up correctly and is successfully syncing users and groups into the catalog.

    In the backend logs, look for a successful synchronization message such as: 

    catalog info Read 114 GitHub users and 22 GitHub groups in 3.4 seconds. Committing...
catalog info Committed 114 GitHub users and 22 GitHub groups in 0.0 seconds.
  2. If users and groups have been ingested into the catalog, verify that the sign-in resolver used (default or configured) matches the correct user attributes.
  3. Optionally, use guest login to look into the user entity in the catalog and verify the attributes. 
Login failed; caused by Error: The <providerId> provider is not configured to support sign-in.

This error indicates that the authentication provider has disableIdentityResolution set to true, meaning it is configured as an auxiliary provider, not for primary sign-in.

To resolve this issue:

  • In your app-config.yaml file, ensure that disableIdentityResolution is not set to true for your primary sign-in authentication provider. 
Login failed, user profile does not contain an email

This error indicates that the authentication client does not have permission to read the user’s email from the identity provider.

To resolve this issue:

  • Grant the necessary email-reading permissions to the authentication client in the identity provider.
  • Or, use a sign-in resolver that does not rely on email, such as preferredUsernameMatchingUserEntityName instead of emailMatchingUserEntityProfileEmail.

8.6. Troubleshoot catalog provider errors
Copy link

Catalog provider plugins can fail to ingest users and groups into the Developer Hub software catalog. The following sections describe common catalog provider errors visible in the backend logs and their solutions.

8.6.1. LDAP: Malformed entity envelope
Copy link

LdapOrgEntityProvider:default refresh failed, TypeError: Malformed entity envelope, TypeError: /metadata/name must NOT have fewer than 1 characters - limit: 1

This error occurs when a user being ingested from LDAP has no value for the name field, which is mapped to the uid LDAP attribute by default.

To resolve this issue:

  • Add a filter to the LDAP users configuration to exclude users without a uid: 

    catalog:
  providers:
    ldapOrg:
      default:
        users:
          - dn: OU=Users,DC=example,DC=com
            options:
              filter: (uid=*)

    For more information about LDAP user filters, see Enable user provisioning with LDAP.

8.6.2. GitHub: API rate limit exceeded
Copy link

GithubMultiOrgEntityProvider:default refresh failed, HttpError: API rate limit exceeded

This error occurs when Developer Hub makes unauthenticated API calls to GitHub, which are limited to 60 requests per hour. Authenticated requests using a GitHub App get up to 5,000 requests per hour.

To resolve this issue:

  • Verify that the integrations.github section is configured in your app-config.yaml file with valid GitHub App credentials. For more information, see Import users and groups from GitHub.

8.6.3. GitLab: API rate limit exceeded
Copy link

This error occurs when Developer Hub makes unauthenticated API calls to GitLab, which are subject to rate limits.

To resolve this issue:

  • Verify that the integrations.gitlab section is configured in your app-config.yaml file with a valid GitLab personal access token. For more information, see Import users and groups from GitLab.
Red Hat logoGithubredditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust. Explore our recent updates.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Theme

© 2026 Red HatBack to top