Sign In Module issues
A checklist for when a module isn't working the way you expect: not appearing on the portal, verification failing, guests getting stuck mid-flow.
When a guest reports a Sign In Module not working, the issue is almost always in one of four places. Walk them in order.
1. Is the module activated on this Context?
Section titled “1. Is the module activated on this Context?”Each Sign In Module has its own activation switch at the top of its admin page. If the module was never activated — or was deactivated by mistake — it won’t appear on the Captive Portal.
- Go to Sign In Modules → module name.
- Confirm the status card says Active. If it says Not Active, click Activate module Login Module.
2. Does the guest’s Access Policy enable the module?
Section titled “2. Does the guest’s Access Policy enable the module?”Three Sign-In Modules — Meeting Host, Email Self-Provisioning, and SAML Login — are additionally gated by an Access Policy under Sign-In Permissions. Activation makes the module available; the policy decides who sees it on the Captive Portal.
Two further actions — Manage Conferences and Manage Whitelistings — are Self-Service Portal actions, gated by the same policy under Self-Service Permissions. They control what a matched Self-Service user can do in the Self-Service Portal, not what a guest sees on the Captive Portal.
- Go to Captive Portal → Access Policies.
- Identify which policy matches the guest (default unless an email pattern or other rule routes them elsewhere).
- Open the relevant Sign-In Permissions or Self-Service Permissions sub-tab and confirm the module’s master toggle is on.
The other modules (Quick Access, SMS, Password, Username & Password, Radius, Event Access) are Context-wide — if they’re activated on the module page, every guest on the Context’s Captive Portal sees them.
3. Are the module’s prerequisites in place?
Section titled “3. Are the module’s prerequisites in place?”Some modules need external pieces:
- SMS needs an SMS provider configured on this Context.
- SAML SSO needs valid IdP metadata imported and attribute mapping set up.
- RADIUS needs a reachable external RADIUS server (see RADIUS diagnostics).
- Conference and Event Access need at least one entry created.
If the module is Active and allowed by policy but prerequisites are missing, sign-ins will fail or the module will misbehave.
4. Is the guest’s device blocked?
Section titled “4. Is the guest’s device blocked?”A device block prevents all modules from completing for that MAC.
- Check Sign In Modules → Blacklistings for the guest’s MAC.
- If found, review the block entry. Contact support if it’s not clear why it was added.
Module-specific patterns
Section titled “Module-specific patterns”Self-Provisioning by Email
Section titled “Self-Provisioning by Email”- Verification email doesn’t arrive. Check the guest’s spam folder and confirm the configured sender domain is allow-listed on the guest’s mail provider.
- Email pattern rejects valid addresses. The Access Policy’s email pattern is an allow-list, not a deny-list. If the guest’s domain isn’t on it, they can’t sign in.
- Code doesn’t arrive. Check the configured SMS provider is actually delivering — per-message logs live with the provider, not in Sign In.
- Wrong country code. The default country code is pre-selected on the portal; guests from other countries have to change it.
SAML SSO
Section titled “SAML SSO”- “Invalid signature” on the ACS callback. The IdP’s signing certificate in the metadata is out of date. Re-download and re-upload.
- Guest authenticates but no login record appears. The attribute mapping is wrong — usually the email attribute. Check the SAML log view for the received assertion and confirm the attribute names match.
- Browser loops back to the portal. The IdP hostname isn’t in the walled garden and can’t be reached pre-auth.
Meeting Host
Section titled “Meeting Host”- Visitor stuck on “waiting for approval”. The host didn’t click the Approve button in the email, or the email didn’t arrive. Check whether the host received the notification. Admins can manually approve from the admin tab as a workaround.
- Host not found. If autocomplete is on and the host’s email isn’t suggested, the host’s address isn’t in the recognised-hosts set.
Conference / Event Access / Password Subscription
Section titled “Conference / Event Access / Password Subscription”- “Invalid code”. The guest’s code has expired (check the entry’s
active window) or was typo’d. Codes with visual ambiguity (
O/0,l/1) are a common culprit. - Code worked for someone else but not this guest. Access Policy device limits may have been reached for that code.
Whitelist
Section titled “Whitelist”- Device not recognised. MAC randomization is the most common reason — see MAC randomization in Apple products.
- Entry expired. Check the entry’s Length policy; timeout and end-date entries can silently lapse.
When the dashboard disagrees with what the guest sees
Section titled “When the dashboard disagrees with what the guest sees”If the guest says “I’m still connected” but the Dashboard shows the session as revoked, an upstream firewall or previous cache may be serving them. Ask the guest to refresh and retry a site they haven’t visited before. If it loads, the guest was on cached data; if it doesn’t, the revoke is in effect.