# insufficient_user_authentication

The admin operation needs a more recent sign-in, or one with a second factor (401).

## Meaning

Deleting a user, setting a password, granting or revoking a role, ending every
session of a user and forgetting a user's remembered browsers need a sign-in no
older than `auth.admin.max_auth_age` (default `15m`), and one with a second factor
when `mfa.required` is on. The token's sign-in time is unknown, too old, or lacks the
second factor. `WWW-Authenticate` carries an RFC 9470 challenge with `max_age`, and
`acr_values` when a second factor is required. A `client_credentials` token has no
sign-in, so it never passes.

## Impact

Nothing changed. A dashboard user is asked to sign in again and the change is
replayed; this is expected after the administrator has been signed in for a while.
An automation using a machine client cannot perform these operations at all.

## Diagnosis

1. Look the request id up on the Troubleshooting page. The refusal is recorded as
   `admin.access.denied` with reason `insufficient_user_authentication` and cause
   `sign_in_unknown`, `sign_in_too_old` or `second_factor_required`.
2. Compare the token's `auth_time` and `amr` claims with `auth.admin.max_auth_age`
   and `mfa.required`.

## Mitigation

- As an administrator: sign in again, with your second factor, and repeat the call.
- As an admin-API developer: re-authorize through `{slug}-admin-console` with the
  `max_age` (and `acr_values`) from the challenge, then replay the call. Do not use
  `{slug}-admin-m2m` for these operations.
- As an operator: lengthen `auth.admin.max_auth_age` (at most `24h`) only if the
  re-prompts are a real burden; a shorter value is safer.

## Escalation

Escalate when a sign-in completed seconds ago, with a second factor, is still
refused. Check the replicas' clocks first. Open an issue with the request id, the
audit cause, the challenge and the server version. Never attach the token.

---

[Problem code runbooks](https://www.nauthera.io/docs/v1/runbooks/problems) · Generated from [`internal/runbook/problems.yaml`](https://github.com/nauthera/nauthera-server/blob/main/internal/runbook/problems.yaml) in nauthera-server.