Troubleshooting

1. What should I do if Step-up AuthN fails?
   Check for error query parameters in the callback:

   • error=step_up_failed: User failed or canceled the 2FA/PBIC challenge.
   • error=access_denied with error_description: Check the description for specific failure reasons.
   Handle these errors by displaying appropriate error messages and allowing the user to retry.
   Reference : Step-up AuthN & identification (portal high risk transaction) , Error case and handling
2. How do I handle SSO registration for first-time inbound SSO users?
   If the user does not have an HSID account associated with the identified EiMP Golden Record, HSID automatically creates an account (SSO Registration). This requires user interaction for email verification, phone verification, and optionally password setup (depending on the Standard vs Headless SSO configuration).
   Reference : Inbound Single Sign On (SSO)
3. What happens when an unmatched account tries to sign in to a matched registration portal?
   The portal displays a "step-up" page where the user must provide EiMP GR identifier information to convert the unmatched account to a matched account before accessing the portal. For hybrid registration portals, the user can skip this step.
   Reference : HSID registration portal / Application configuration types

Multi-language support

1. Does HSID support multiple languages?
   Yes, HSID supports multiple languages. Use the ui_locales parameter in the OIDC authorization request to specify the desired language (for example, ui_locales=en for English and ui_locales=es for Spanish).
   Reference : Multi-language support