Skip to content

The v1 docs follow nauthera-server's main branch and its 0.x releases on the way to 1.0, so fields and APIs can still change.

v1

insufficient_user_authentication

Docs version v1 (main)Nauthera is pre-1.0, in a design-partner program

The admin operation needs a more recent sign-in, or one with a second factor (401).

Meaning

Deleting a user, setting a password, granting or revoking a role, ending every session of a user and forgetting a user's remembered browsers need a sign-in no older than auth.admin.max_auth_age (default 15m), and one with a second factor when mfa.required is on. The token's sign-in time is unknown, too old, or lacks the second factor. WWW-Authenticate carries an RFC 9470 challenge with max_age, and acr_values when a second factor is required. A client_credentials token has no sign-in, so it never passes.

Impact

Nothing changed. A dashboard user is asked to sign in again and the change is replayed; this is expected after the administrator has been signed in for a while. An automation using a machine client cannot perform these operations at all.

Diagnosis

  1. Look the request id up on the Troubleshooting page. The refusal is recorded as admin.access.denied with reason insufficient_user_authentication and cause sign_in_unknown, sign_in_too_old or second_factor_required.
  2. Compare the token's auth_time and amr claims with auth.admin.max_auth_age and mfa.required.

Mitigation

  • As an administrator: sign in again, with your second factor, and repeat the call.
  • As an admin-API developer: re-authorize through {slug}-admin-console with the max_age (and acr_values) from the challenge, then replay the call. Do not use {slug}-admin-m2m for these operations.
  • As an operator: lengthen auth.admin.max_auth_age (at most 24h) only if the re-prompts are a real burden; a shorter value is safer.

Escalation

Escalate when a sign-in completed seconds ago, with a second factor, is still refused. Check the replicas' clocks first. Open an issue with the request id, the audit cause, the challenge and the server version. Never attach the token.

Problem code runbooks · Generated from internal/runbook/problems.yaml in nauthera-server.