❓ Login: Authentication failed despite correct password (SAML/Standard)

It can happen that users are unable to log in to FTAPI even though they are certain they are using the correct password. The login fails repeatedly and causes confusion.

The most common cause for this issue is not the password itself, but the login method used or incorrect data saved by the browser. This occurs particularly when:

• Users who log in via Single-Sign-On (SAML) attempt to use the fields for username and password.
• Standard users attempt to log in via the SAML button.
• The browser automatically inserts outdated or incorrect passwords into the login fields (autofill).

Solution for users

To resolve the issue, it is crucial to use the correct login method for your account type.

For SAML users (Single-Sign-On)

As a SAML user, you must exclusively use the SAML-Login button (or similarly named). Logging in via the username and password fields is not possible.

If you as a SAML user attempt to reset your password via the "Forgot password" function, you will receive an email notification informing you that this is not intended for SAML accounts. Your password management is handled exclusively via your organization's Identity Provider (IdP) (e.g., Microsoft Azure AD).

For standard users (username/password)

If you are a standard user, please always log in via the designated username and password fields. Under no circumstances should you use the SAML-Login button.

Browser cache and autofill as a source of error

Browsers tend to save credentials to facilitate future logins. Sometimes, however, old or incorrect passwords are saved here, which makes the autofill function unreliable.

If the login continues to fail, please perform the following steps:

1. Delete saved passwords: Remove all passwords saved for the FTAPI page from your browser's settings.
2. Clear browser cache: Clear your browser's cache to ensure that no outdated data is loaded.
3. Manual entry: Enter your username and password manually after deleting the data and do not rely on the autofill function.

Technical background for administrators

Authentication and password storage with SAML

For security reasons, FTAPI does not store passwords for SAML users. When a SAML user uses the correct login button, the authentication request is forwarded to the organization's configured Identity Provider (IdP). The IdP checks the credentials and returns a confirmation to FTAPI upon success. This process ensures that password management remains entirely under the customer's control and strengthens security through the separation of responsibilities.

Automatic reactivation of SAML/LDAP accounts

A deactivated SAML or LDAP account is automatically reactivated upon the user's next successful login via the IdP. To permanently prevent reactivation, the administrator must revoke the user's corresponding roles directly in the Identity Provider (e.g., by removing them from the relevant Active Directory group).