Skip to main content
Version: 0.0.15 (latest)

Troubleshooting

Identity not recognized​

Symptom: Mount fails with "identity not found" or "unauthorized"

Check that:

  1. The certificate name exactly matches the Identity Name shown in Identity & Access → Users & Groups (or Machines)
  2. The identity status is Active — a revoked identity cannot authenticate
  3. The certificate has not expired. mass-ctl login certificates last 24 hours by default; run mass-ctl login again to get a fresh one, or use --validity-hours up to 168 (7 days).
info

A blank or whitespace-only certificate name is rejected with a validation error when you create or update the identity, and surrounding whitespace is trimmed automatically.

Access policy not taking effect​

Symptom: The user can authenticate but gets "access denied" on data operations

  1. Navigate to Identity & Access → Access Rules → Storage Access and find the policy
  2. Verify Scope and Direct Target match the resource exactly
  3. Verify the Permission Level covers the operation
  4. Check Sync Status — if it stays SYNCING for more than a few minutes, or shows FAILED, check System → Logs for a warning, then contact MangoBoost support through System → Support
  5. If the volume is already mounted, remount it — permission changes reach an existing mount only after a remount

Directory (LDAP) sign-in fails​

  • Configuration mistakes are caught and explained when you save on Identity & Access → Auth Settings — read the error there first
  • For a directory server behind a public CA (such as Google Secure LDAP), leave the CA certificate field empty; clearing an incorrect CA certificate takes effect immediately
  • Check the Auth source order — if the same username exists in several sources, the first matching source wins. Users can select a source explicitly with mass-ctl login --source ldap:0.
  • If first-time account provisioning fails, sign-in returns a clear, retryable error rather than issuing a session with no access

Group-based access does not apply​

A user's effective roles include those inherited from groups. If a group policy is not applying:

  1. Confirm the user is listed on the group's Members tab
  2. For an LDAP group, confirm the directory reports the membership — group-based policies work even with directories that do not list group membership on each user account, but the group itself must sync
  3. Role and scope changes take effect immediately; if the dashboard menu still looks wrong, reload the page

Two identities with the same name​

When two identities from different domains share the same name (for example alice@corp.com and alice@lab.example), a warning is shown because they would collide. Give one of them a distinct certificate name.

Certificate expired​

Run mass-ctl login again on the client. There is no separate renewal action in the Dashboard — signing in issues a new certificate.

For a machine identity, re-run sudo mass-ctl machine register on the host. If the machine was revoked, delete it from Identity & Access → Machines first, then register again.