Authentication Troubleshooting

# Overview

This guide covers solutions to login, password, session, and access control issues. The BATbern platform uses AWS Cognito for authentication, providing enterprise-grade security. Users sign in either with email and password or with “Continue with Google” (Google SSO federation, live since Epic 12). Speakers, partners, and attendees all use the same Cognito login — there is no separate “magic link” login for any role.

Multi-role users (for example, an organizer who is also a speaker) sign in once and get a single session with role-grouped navigation — see Multi-Role Single Session.

# Quick Diagnosis

Use this flowchart to identify your issue:

Can you access the login page?
│
├─ NO → [Network/Browser Issue](#cant-access-login-page)
│
└─ YES → How are you signing in?
    │
    ├─ "Continue with Google" → Does it fail?
    │   ├─ Bounced back to login → [Google SSO Issues](#continue-with-google-sso-issues)
    │   ├─ "Account inactive/disabled" → [Account Inactive](#account-inactive-gating)
    │   └─ Stuck on Terms screen → [Terms-of-Service Consent Gate](#first-login-terms-of-service-consent-gate)
    │
    └─ Email + password → Do you know your password?
        │
        ├─ NO → [Reset Password](#forgot-password)
        │
        └─ YES → Does login fail with error?
            │
            ├─ "Invalid username or password" → [Invalid Credentials](#invalid-credentials)
            ├─ "Account locked" → [Account Locked](#account-locked)
            ├─ "Session expired" → [Session Expired](#session-expired)
            └─ Other error → See [Error Messages](#error-messages)

# Login Failures

# Invalid Credentials

Symptom: Error message “Invalid username or password” or “Incorrect login credentials”

Possible Causes:

1. Typo in email or password
2. Wrong account (personal vs. work email)
3. Password recently changed (using old password)
4. Caps Lock enabled (password is case-sensitive)

Solutions:

Step 1: Verify Email Address

1. Check for typos (common: .com vs .ch, gmail vs gmial)
2. Verify you're using work email (not personal)
3. Try both email formats if unsure:
   - john.doe@company.ch
   - johndoe@company.ch

Step 2: Check Password

1. Turn off Caps Lock
2. Copy-paste password from password manager (avoids typos)
3. Toggle "Show Password" checkbox to verify characters
4. Try last known password if recently changed

Step 3: Reset Password

If still failing after verification:
1. Click "Forgot Password?" link on login page
2. Follow email instructions (check spam folder)
3. Create new password meeting requirements:
   - Minimum 8 characters
   - At least 1 uppercase letter
   - At least 1 lowercase letter
   - At least 1 number
   - At least 1 special character (!@#$%^&*)

Prevention:

• Use password manager (1Password, LastPass, Bitwarden)
• Save correct email address in password manager notes
• Enable “Remember Me” for trusted devices (30-day sessions)

# Forgot Password

Symptom: Don’t remember password, need to reset

Solution: Password Reset Flow

Step 1: Request Reset

1. Go to https://app.batbern.ch/login
2. Click "Forgot Password?" link below login form
3. Enter your email address (the one you use to log in)
4. Click "Send Reset Code"

Step 2: Check Email

1. Check inbox for "BATbern Password Reset" email
2. Email arrives within 5 minutes (if delayed, check spam folder)
3. Add noreply@batbern.ch to contacts (prevents future spam filtering)
4. Note: Reset code expires in 15 minutes

Step 3: Create New Password

1. Copy 6-digit code from email
2. Return to reset page (or click link in email)
3. Enter verification code
4. Create new password meeting requirements:
   - Minimum 8 characters
   - Mix of uppercase, lowercase, number, special char
   - Cannot match last 5 passwords
5. Confirm password (type again)
6. Click "Reset Password"

Step 4: Log In

1. Automatic redirect to login page
2. Enter email and NEW password
3. Success! You're logged in

Troubleshooting Reset Issues:

# “Continue with Google” SSO Issues

Symptom: Clicking “Continue with Google” returns you to the login page, shows an error, or doesn’t complete sign-in

BATbern supports Google SSO via Cognito federation at auth.batbern.ch. When you sign in with Google, the platform transparently links your Google identity to your BATbern account by matching your email address. If no BATbern account exists for that email, one is provisioned for you on the spot (just-in-time provisioning) with the default ATTENDEE role.

Possible Causes:

1. Google account uses a different email than your BATbern account
2. First-time Google sign-in hasn’t completed the consent/onboarding steps yet
3. Browser blocked the pop-up or third-party cookies for the federated redirect
4. Account is inactive/disabled (see Account Inactive)
5. SSO temporarily disabled by an administrator (runtime kill-switch)

Solutions:

Step 1: Verify the Email Matches

1. Account linking is by EMAIL address
2. Sign in to Google and confirm which email that account uses
3. It must match the email on your BATbern account
   - If they differ, ask an admin to align them, OR
   - Use email + password login with your BATbern email instead

Step 2: Allow Pop-ups and Cookies

1. The Google redirect uses auth.batbern.ch + Google's domains
2. Allow pop-ups for app.batbern.ch
3. Allow third-party cookies for the sign-in flow (corporate browsers
   often block these)
4. Disable strict tracking-prevention / privacy extensions for the login
5. Retry "Continue with Google"

Step 3: Complete First-Login Onboarding

A brand-new Google sign-in must finish onboarding before you land in the app:
1. Accept the Terms of Service (see consent gate below)
2. Confirm/complete your profile (company, newsletter preference)
3. Only after these steps does the session become fully usable

Step 4: If “Continue with Google” Is Missing

1. The button may be hidden if SSO is temporarily disabled by an admin
   (runtime kill-switch)
2. Use email + password as a fallback
3. Report to support if the button is unexpectedly gone

Note: You can link Google sign-in to an existing email/password account — they resolve to the same BATbern account as long as the email matches. You do not get a duplicate account.

# First-Login Terms-of-Service Consent Gate

Symptom: After signing in (especially with Google for the first time), you’re held on a Terms of Service screen and can’t reach the dashboard

Cause: This is by design. On first login, every account must accept the current Terms of Service before any further access is granted. The consent gate also collects onboarding details (company, newsletter opt-in) for federated sign-ins.

Solutions:

1. Read and accept the Terms of Service (tick the consent box)
2. Complete any required onboarding fields (e.g. company)
3. Click "Continue" / "Accept"
4. You are then redirected into the platform with a full session

If You Can’t Get Past the Gate:

1. Ensure the consent checkbox is ticked (the button stays disabled otherwise)
2. Fill in all required onboarding fields (red asterisks)
3. Hard refresh (Ctrl+Shift+R / Cmd+Shift+R) and retry if the button won't enable
4. Check the browser console (F12 → Console) for errors and send to support

Note: You only see this gate again if the Terms are updated and re-consent is required. Day-to-day logins skip it.

# Account Inactive Gating

Symptom: Login succeeds at Google/Cognito but BATbern shows “Account inactive” / “Your account is not active” and denies access

Cause: Your BATbern account exists but is not active. Active status is enforced at the gateway — a deactivated account cannot use the platform even with valid Google or password credentials.

Solutions:

1. Contact an administrator to confirm your account status
2. Email support@batbern.ch with subject "Account Inactive"
   - Include your login email
   - State which role you expect (organizer, speaker, partner, attendee)
3. An admin reactivates the account; sign in again afterwards

Note: Being added to the speaker pool (including via self-nomination at the IDENTIFIED state, Epic 7 “I Could Speak on That”) is not the same as having an active login. A Cognito user is provisioned only later in the speaker workflow (at the READY transition). Until then, sign-in for that speaker may report no/inactive account.

# Multi-Role Single Session Issues

Symptom: You hold more than one role (e.g. ORGANIZER + SPEAKER, or PARTNER + ATTENDEE) and aren’t sure how to switch, or expected role-specific features are missing

Cause / By Design: Since the unified workflow refactor (Epic 11), a multi-role user gets one account, one login, and one session. There is no separate login per role and no “switch role” re-authentication. The navigation simply shows role-grouped sections (section dividers per role) so every capability you’re entitled to is available at once.

Solutions:

1. Sign in once (email/password OR Continue with Google)
2. Look for role-grouped sections in the navigation/sidebar
   - Each role you hold contributes its own section/divider
3. If a role's section is missing:
   - Go to Settings → Profile and check assigned roles
   - Contact an admin if a role you expect is not listed
4. Do NOT create a second account to "log in as" another role —
   that produces a duplicate and splits your data

Note: If you previously kept separate logins for separate roles, consolidate onto a single account (matching email). Account linking is by email, so Google + password on the same email resolve to one account.

# Account Locked

Symptom: Error message “Your account has been locked due to too many failed login attempts”

Cause: Security measure after 5 consecutive failed login attempts within 15 minutes

Solution:

Option 1: Wait (Automatic Unlock)

Account automatically unlocks after 30 minutes
- No action required
- Failed attempt counter resets
- Try logging in again after 30 minutes

Option 2: Unlock via Email (Faster)

1. Check email for "Account Locked - Action Required" message
2. Click "Unlock My Account" link in email
3. Complete verification (may require answering security question)
4. Account unlocked immediately
5. Reset password if you don't remember it

Option 3: Contact Admin (Immediate)

If urgent and can't wait:
1. Email support@batbern.ch with subject "Account Unlock Request"
2. Include your name, email, and reason for urgency
3. Admin can manually unlock within business hours (response within 2-4 hours)

Prevention:

• Use password manager to avoid typos
• Don’t share passwords (prevents others from locking your account)
• Enable “Remember Me” on trusted devices
• Reset password immediately if uncertain

# Session Issues

# Session Expired

Symptom: Error “Your session has expired. Please log in again.” or automatic redirect to login page

Cause: Security tokens expire after period of inactivity or absolute time limit

Session Duration:

• Active session: 8 hours from login (with activity)
• Idle timeout: 2 hours of no activity
• “Remember Me”: 30 days (refreshes on each login)

Solutions:

Immediate Fix:

1. Click "OK" on expiration message (auto-redirects to login)
2. Log in again with your credentials
3. Return to previous page (browser history maintained)

Prevent Future Expirations:

1. Enable "Remember Me" at login
   - Extends session to 30 days
   - Safe on personal/trusted devices only

2. Keep browser tab open and active
   - Session refreshes with activity
   - Activity = clicks, form edits, page navigation

3. Use multiple browser tabs
   - Session shared across tabs
   - Any tab activity refreshes all tabs

4. Set calendar reminder
   - Reminder at 1.5 hours to click something
   - Prevents idle timeout

Work in Progress Protection:

If working on long forms:
1. Platform auto-saves draft every 2 minutes
2. On session expiry + re-login, draft auto-restores
3. Manual save: Click "Save Draft" button (top-right)
4. Drafts retained for 7 days

# Stuck on “Logging In…” (Infinite Spinner)

Symptom: Login form submitted, spinner shows, but never completes

Possible Causes:

1. Network timeout (slow connection or firewall blocking)
2. Browser cookie/storage issues
3. AWS Cognito service disruption (rare)
4. Corporate proxy interfering

Solutions:

Step 1: Check Network

1. Verify internet connection (open google.com in new tab)
2. Check status page: https://status.batbern.ch
3. Try different network (mobile hotspot vs WiFi)

Step 2: Browser Cleanup

1. Open browser console (F12 → Console tab)
2. Look for errors (red text)
3. Clear browser cache/cookies:
   - Settings → Privacy → Clear Browsing Data
   - Select "Cookies" and "Cached images"
   - Time range: "Last 24 hours"
4. Hard refresh: Ctrl+Shift+R (Cmd+Shift+R on Mac)
5. Try login again

Step 3: Try Different Browser

1. Open incognito/private window in same browser
2. If works → Browser extension issue
3. If still fails → Try different browser (Chrome recommended)
4. If works in other browser → Clear first browser completely

Step 4: Bypass Proxy (Corporate Networks)

If on corporate network:
1. Contact IT to whitelist these domains:
   - app.batbern.ch
   - cognito-idp.eu-central-1.amazonaws.com
   - *.amazoncognito.com
2. Try VPN or mobile hotspot as workaround

If Still Failing:

Contact support with:
- Browser console screenshot (F12 → Console)
- Network tab screenshot (F12 → Network)
- Browser name and version
- Network type (corporate, home, mobile)

# Access Control Issues

# “Access Denied” or “Permission Error”

Symptom: Error message “You do not have permission to access this resource” or “Access denied”

Possible Causes:

1. Insufficient role permissions (wrong role assigned)
2. Trying to access another organizer’s private event
3. Feature not enabled for your organization
4. Account not yet approved by admin

Solutions:

Verify Your Role:

1. Go to Settings → Profile
2. Check "Role" field:
   - ORGANIZER → Full access to assigned events
   - ADMIN → Full access to all events + user management
   - SPEAKER → Limited access to own materials only
   - ATTENDEE → Read-only access to published events
3. If wrong role → Contact admin to update

Check Feature Permissions:

Some features restricted by role:
- Create Events → ORGANIZER or ADMIN only
- Manage Users → ADMIN only
- Delete Entities → ADMIN only
- Workflow Advancement → ORGANIZER (assigned to event) or ADMIN

If you need higher permissions:
1. Email admin with justification
2. Include specific feature you need access to
3. Admin will review and update role if appropriate

Event-Specific Access:

If error on specific event:
1. Check if you're assigned organizer for that event
2. Go to Events → [Event] → Settings → Organizers
3. Verify your name in organizer list
4. If not listed → Contact admin to be added

# Multi-Factor Authentication (MFA) Issues [PLANNED]

Symptom: Can’t complete MFA setup or MFA code not working

Note: MFA is planned for future release. Currently not required.

When Available:

• Optional for all users, required for ADMIN role
• Supports authenticator apps (Google Authenticator, Authy)
• SMS backup codes available
• Recovery codes for lost device scenarios

# Error Messages Reference

# Common Error Codes

# AWS Cognito Error Messages

# Google SSO / Federation Messages

# Browser Console Errors

If experiencing authentication issues, browser console may show helpful errors.

How to Access Console:

Chrome/Firefox/Edge:
- Press F12
- Click "Console" tab
- Look for red error messages

Safari (macOS):
- Enable Developer menu: Safari → Preferences → Advanced → Show Develop menu
- Develop → Show JavaScript Console

Common Console Errors:

“NetworkError: Failed to fetch”

Cause: Network connectivity or CORS issue
Solution:
1. Check internet connection
2. Disable VPN temporarily
3. Contact IT to whitelist app.batbern.ch

“CORS policy: No ‘Access-Control-Allow-Origin’ header”

Cause: Browser extension blocking requests or outdated cache
Solution:
1. Disable browser extensions
2. Clear cache and hard refresh
3. Try incognito mode

“401 Unauthorized”

Cause: Session expired or invalid auth token
Solution:
1. Log out completely (Settings → Log Out)
2. Clear cookies for app.batbern.ch
3. Log in again

# Prevention Best Practices

# Password Management

1. Use a Password Manager

   • Recommended: 1Password, Bitwarden, LastPass
   • Auto-generates strong passwords
   • Auto-fills login forms (reduces typos)
   • Syncs across devices

2. Create Strong Passwords

   • Minimum 12 characters (longer is better)
   • Mix of uppercase, lowercase, numbers, symbols
   • Avoid common words or personal info
   • Unique per site (don’t reuse BATbern password)

3. Secure Password Storage

   • Never write down passwords
   • Don’t share passwords via email/chat
   • Don’t store in browser notes or documents
   • Use password manager’s secure notes feature

# Session Management

1. “Remember Me” Usage

   • Enable only on trusted, personal devices
   • Never on shared or public computers
   • Extends session to 30 days (more convenient)

2. Logging Out

   • Always log out on shared computers
   • Use “Log Out Everywhere” if suspect unauthorized access
   • Settings → Security → Log Out All Sessions

3. Session Security

   • Don’t leave logged-in sessions unattended
   • Lock computer when away (Win+L or Cmd+Control+Q)
   • Close browser completely at end of day

# Account Security

1. Email Verification

   • Verify email immediately on account creation
   • Add noreply@batbern.ch to contacts (prevents spam filtering)
   • Update email if changing work address

2. Regular Password Updates

   • Change password every 6-12 months
   • Change immediately if suspect compromise
   • Never reuse old passwords

3. Monitor Account Activity

   • Review “Recent Activity” log (Settings → Security)
   • Unrecognized logins → change password immediately
   • Report suspicious activity to support@batbern.ch

# Getting Additional Help

# Before Contacting Support

1. Try solutions in this guide
2. Clear browser cache and try incognito mode
3. Test on different browser
4. Gather error details (screenshots, console errors)

# Contact Support

Email: support@batbern.ch

Include:

• Your email address (the one you use to log in)
• Error message screenshot
• Browser console screenshot (F12 → Console)
• Steps you’ve already tried
• Urgency level (if critical, say so)

Response Times:

• Critical (can’t access at all): 2-4 hours
• High priority: 8-12 hours
• Standard: 1-2 business days

# Related Resources

• Getting Started → Login - Initial authentication setup
• User Management - Roles and permissions
• Security Settings - Managing your account security
• Troubleshooting Overview - Other common issues

Next: Explore File Upload Troubleshooting →