Trouble Shooting

This chapter covers common account and sign-in problems in Weincloud. Each symptom is listed with its cause, how to identify it, and how to resolve it, so that users and administrators can quickly locate the reason when a login fails or an operation is rejected.

Intended audience and scope:

• End users: self-service troubleshooting for failed logins, forgotten passwords, missing verification emails, and multi-factor authentication (MFA) problems.
• Domain Superuser and Subdomain Superuser: unlocking member accounts, resetting MFA, and verifying whether a Domain-level policy is the source of the problem.
• This chapter does not cover HMI activation and licensing, EasyAccess 2.0 connectivity, or Dashboard project errors. Refer to the corresponding chapters for those topics.

How Errors Are Presented

Before diagnosing a problem, identify which layer produced the message. This narrows the scope of investigation:

Presentation	Source	Characteristics
Red hint below a field	Client-side format validation	No request was sent; the field format is simply invalid
Floating notification (toast)	Error returned by the server	Disappears after about 5 seconds; the text states the actual cause
Dialog or system prompt	An event that requires confirmation to continue	For example, an expired session that forces a redirect to the login page
Dedicated error page	Route-level access failure	Displays a status code such as 403, 404, or 503

Some errors also trigger an automatic redirect — for example, insufficient password strength redirects to the password reset page. A redirect immediately after a message is expected behavior; follow the instructions on the destination page.

Unable to Log In

The login page requires three values: [Domain], [Username], and [Password]. The username of the administrator account is always admin.

Before the request is sent, the browser checks the following. The request is not submitted until these pass:

• All three fields are required.
• The password must be at least 6 characters; the field accepts a maximum of 16 characters.

If the login still fails after these checks pass, identify the cause from the message returned by the server:

Message	Cause	Resolution
This domain name does not exist	The Domain name is misspelled, or the Domain has not been created	Verify the Domain name. Domain names are 4–32 characters and may contain only letters, numbers, and underscores
User does not exist	No such username exists in that Domain	Verify the username. The administrator account is admin. Usernames are 4–32 characters
Password is incorrect	The password is wrong	Re-enter it. Repeated failures trigger a lockout — see Account Locked
Domain not confirmed yet	Email confirmation was not completed after registration	See Account Not Yet Verified

If all three values are correct and login still fails, check the restrictions described in the sections below.

Account Locked

When consecutive failed authentication attempts reach the threshold, the account is locked and further attempts fail even with the correct password or verification code.

Passwords and verification codes (OTP) are counted separately against independent thresholds; reaching either one triggers the lock. These thresholds are fixed by the system and do not vary with the Domain method:

Authentication type	Threshold
Password	20 consecutive failures
Verification code (OTP)	5 consecutive failures

The verification code counter covers every step that requires a 6-digit code, including the [Two-Factor Authentication] screen and email verification code login. An account can therefore be locked while the password is entirely correct, purely from repeated verification code errors.

How the lock is released is determined by the [Failed Attempts Method] of the Domain:

Method	Message	Release
[Default]	Your account has been temporarily locked. Please try again in 30 minutes.	Locked for 30 minutes, then released automatically
[Stricter]	Login attempts have reached the limit. Please contact the administrator to unlock.	Never released automatically; an administrator must release it

The method is a Domain-level setting that applies to all users in that Domain. See Setting – Failed Attempts Method. If the Domain is left at [Not set], lockout protection still applies and behaves the same as [Default].

Exception for the admin account

The account with the username admin is not subject to the persistent lock of the [Stricter] method. Regardless of the method configured for the Domain, a lock on admin is always temporary — 30 minutes, then released automatically, with no assistance required.

Resolution:

• [Default] method: wait 30 minutes and try again. If the correct password is unknown, use the password reset flow instead — the lock is released as soon as the reset succeeds, with no waiting.
• [Stricter] method: completing a password reset releases the lock without assistance. If a password reset is not possible, contact the Domain Superuser of the Domain to run [Unlock] on the account from the [User] page. Only a Domain Superuser can perform this action, and the option appears only while the account is locked. See User Management.
• admin account: regardless of the method, wait 30 minutes and try again, exactly as under the [Default] method.
• Locked by verification code errors: the release procedure is the same. After the lock is released, confirm that valid codes can be obtained — see Multi-Factor Authentication (MFA) Problems — before signing in again, to avoid triggering the lock a second time.

Login IP Not Allowed

The message "This IP is not allowed to log in." indicates that login IP restrictions are configured for the account and the current source address is outside the allowed ranges. This restriction applies only to accounts with the username admin.

Resolution:

• Log in from an allowed network, such as the corporate intranet or a designated site.
• To change the allowed ranges, first log in from a source inside the current ranges, then edit [Login IP Restrictions] on the [Profile] page. See Profile – Login IP Restrictions.

Before saving login IP restrictions, confirm that the list includes the IP address you are currently using; otherwise you will not be able to log in from that location.

Password Strength Requirement Not Met

After [Password Strength] is enabled for a Domain, existing passwords do not expire immediately. They are evaluated at the next login. If the current password does not meet the requirement, the system displays "Password strength does not meet security requirements. Please change your password immediately." and redirects to the password reset page. The password must be changed before the account can be used.

In this case the requirements are stricter than usual: the minimum length increases from 6 to 8 characters, and the password must contain uppercase letters, lowercase letters, numbers, and special characters. See Setting – Password Strength.

Account Not Yet Verified

A newly registered Domain must complete email confirmation before login is possible. After registration, a confirmation email is sent to the address provided during registration; clicking the link in that email activates the account.

Logging in before confirmation displays "Domain not confirmed yet". Resolution:

1. Check the inbox and the junk mail folder of the registered address.
2. If no email arrived, click [Did not receive email] on the login page, enter the Domain and username, and click [Send]. The verification link is sent again.
3. If the link leads to "Link Expired", the link is invalid or has expired. Repeat the previous step to obtain a new one.

For the registration procedure, see Getting Started with Weincloud.

Privacy Policy Updated

When the privacy policy is updated, consent is requested again at login with the message "We have updated our Privacy Policy. Please agree to continue using Weincloud". Review and accept the policy to continue; no other function is accessible until consent is given.

Forgotten Password and Password Reset

A password reset resolves both a forgotten password and an account lockout: the lock is released as soon as the reset succeeds, regardless of the [Failed Attempts Method] configured for the Domain.

Requesting a Reset Link

1. Click [Forgot password] on the login page to open the [Reset Password] dialog.
2. Enter [Domain] and [Username]. Both fields are required.
3. Click [Send]. On success, "Password reset email has been sent." is displayed and the reset link is sent to the email address of that account.

If the Domain or username does not exist, the dialog stays open and reports the reason, so the values can be corrected and submitted again.

Setting a New Password

Open the link from the email to reach the [Reset Password] page, enter [New Password] and [Confirm Password], then click [Set New Password].

• The password must be 6–16 characters. If the reset was triggered by the password strength policy, the minimum is 8 characters.
• Both entries must match.
• While typing, a four-segment strength indicator ([Weak], [Fair], [Good], [Strong]) shows the estimated strength for reference.

On success, the page displays "Your password has been updated. You can now sign in with your new password." and returns to the login page, where the new password must be used.

When a Reset Fails

Symptom	Cause	Resolution
The link opens a 404 page	The URL is missing the reset token, usually because the link was truncated or copied incompletely	Click the complete link in the email again, or request a new reset email
An error appears after clicking [Set New Password]	The reset link has expired or has already been used	Request a new reset email. Each reset email can be used only once
No reset email arrives	See System Emails Not Received	—

System Emails Not Received

Weincloud sends registration confirmations, password reset links, and verification codes by email. If no email arrives, check the following in order:

1. Confirm the destination address: verification and reset emails are sent to the email address registered for the account, not to the username entered at login.
2. Check the junk mail folder: system emails may be classified as spam.
3. Check the resend interval: resending a verification code is rate-limited. Requesting it too frequently displays "You can resend the verification code after 60 seconds"; wait for the countdown to finish.
4. Check whether the code has expired: verification codes are time-limited. Using an expired code displays "Confirmation code expired"; request a new one.
5. Confirm the email address is correct: after logging in, the address and its verification status can be reviewed and changed on the [Profile] page. See Profile – Email.

If the registered address can no longer receive mail and has not been updated, contact the Domain Superuser of the Domain for assistance.

Multi-Factor Authentication (MFA) Problems

When MFA is enabled, a successful password check leads to the [Two-Factor Authentication] step, which requires a 6-digit code. The source of the code depends on the configured method: [Email OTP] sends it to the registered email address, while [Email + TOTP App] generates it in an authenticator app and uses email as a fallback.

Symptom	Resolution
The email verification code does not arrive	Click [Resend code]. The button is disabled until the countdown ends. Also follow System Emails Not Received
Codes from the authenticator app are always rejected	TOTP codes are time-based. Verify that the device clock is set to automatic time synchronization and that the time zone is correct, then request a new code
The phone was replaced or the authenticator app was lost	[Email + TOTP App] uses email as a fallback, so the code can be received by email instead. After logging in, reconfigure MFA on the [Profile] page to bind the new device
Neither email nor the authenticator app is available	Contact the Domain Superuser of the Domain to run [Reset MFA] on the account from the [User] page. Only a Domain Superuser can perform this action, and the option appears only while MFA is enabled for that user
[Email OTP] and [Email + TOTP App] cannot be selected	The email address of the account is not verified. Complete email verification first — see Profile – Verify Email
The account is locked after repeated code errors	Five consecutive verification code errors lock the account — a much lower threshold than the 20 allowed for passwords. See Account Locked for how the lock is released

For MFA configuration and the resulting login flow, see Profile – Multi-Factor Authentication.

Social Login Problems

The following situations may occur when signing in with Google, Microsoft, Apple, WeChat, or an email one-time passcode:

Message or symptom	Cause	Resolution
This social login account is already bound to another user	A Weincloud account can have only one social account at a time, and the account you are linking already has one	Sign in with the social account already linked to it, or unlink it first on the [Profile] page of that account and then link again
Social login token is invalid / has expired	The authorization flow timed out, or the authorization page was left open too long	Return to the login page and start the social login again
Social login state not found	The authorization flow was interrupted, for example by refreshing the page or using the browser back button	Return to the login page and start again; do not refresh or leave the page during the flow
The email passcode is reported as expired	One-time passcodes are time-limited; the remaining time is shown as a countdown	Click [Resend code] to obtain a new passcode
The WeChat QR code is reported as expired	QR codes are time-limited	Reopen the login dialog to obtain a new QR code
[Choose Account] appears with an empty list after authorization	The social account is not linked to any Weincloud account yet	Follow the dialog to [Create New Account] or [Link Existing Account]

For the social login mechanism, the available providers, and how social identities map to Weincloud accounts, see Social Login and Social Login — How Social Identities Map to Weincloud Accounts.

TIP

The available providers are determined by the server: the global server offers Email, Google, Microsoft, and Apple; the China server offers Email and WeChat.

Sessions and Forced Logout

After login, the session is maintained automatically and the token is renewed in the background, normally without the user noticing. The following situations end a session:

Symptom	Cause	Resolution
A prompt states that the session has expired and redirects to the login page	The token is no longer valid and cannot be renewed, for example after a long idle period	Log in again. The original page address is preserved and reopened after login
Logged out unexpectedly during use	The session was logged out from another device, or the account password was changed	Log in again. Active login records can be reviewed under [Login Sessions] on the [Profile] page — see Profile – Login Sessions
Re-login is required after changing the password	A successful password change forces re-authentication	Log in with the new password. This is expected behavior
After login the browser stays on the [Profile] page and no other page can be opened	The email address is not verified, or the account is scheduled for deletion	Complete email verification. If the account is scheduled for deletion, run [Cancel Deletion] to restore it — see Profile – Cancel Deletion

If an unexpected login record is found, immediately run [Log Out All], change the password, and enable MFA.

Permission and Page Access Errors

Symptom	Cause	Resolution
"Permission denied", "You don't have permission to access", or "Permission check fail" is displayed	The role or folder scope of the current account is not sufficient for the operation	Determine the required permission and request it from a Domain Superuser. For the permission model, see User Management and Manage by Subdomain
A function is missing from the menu	Menu items are shown according to account permissions; items without permission are hidden	As above, verify that the account holds the permission the function requires
A 403 error page is displayed	A page without permission was opened directly by URL	Return to the [Directory] page and reach permitted functions through the menu
A 404 error page is displayed	The URL is wrong, or the resource has been deleted	Verify the URL. If the page was opened from a bookmark or an old link, navigate again from the menu

After an administrator changes permissions, the affected user must log in again before the new menu and access scope take effect.

Service Temporarily Unavailable

Message or symptom	Cause	Resolution
You have sent too many requests	Requests within a short period exceeded the server limit	Stop repeating the operation and retry later. Avoid clicking a submit button repeatedly
Server unavailable	The server cannot respond at the moment	Retry later; contact customer service if the problem persists
The service is having an internal problem	A server-side failure occurred	Retry later. If it keeps failing, record the steps and the time, then contact customer service
A 503 error page is displayed	The server is overloaded or under maintenance	Retry later
The page fails after a long period without response	The request timed out (30-second limit)	Narrow the query and retry, for example by shortening the date range or adding filters

Limitations and Notes

Item	Limitation
Domain name	4–32 characters; letters, numbers, and underscores only
Username	4–32 characters; cannot be changed by the user
Password length	6–16 characters; minimum 8 characters when [Password Strength] is enabled for the Domain
Failed login lockout	20 password failures or 5 verification code (OTP) failures; counters are separate
Lock release	[Default]: released automatically after 30 minutes. [Stricter]: administrator release required
Scope of [Stricter]	Does not apply to admin; that account is always released automatically after 30 minutes
Verification code resend	60-second interval
Verification links and codes	Time-limited and must be requested again after expiry; a password reset link can be used only once
Login IP restrictions	Available only to accounts with the username admin; up to 5 entries; IPv4 CIDR only
Unlock account, reset MFA	Domain Superuser only
Request timeout	30 seconds

FAQ

Q: How long does a locked account stay locked?

A: It depends on the [Failed Attempts Method] of the Domain. The [Default] method releases the lock automatically after 30 minutes; the [Stricter] method never releases it automatically and requires a Domain Superuser to unlock the account. Both methods share the same thresholds and differ only in whether the lock is released automatically.

The account with the username admin is the sole exception: regardless of the method, its lock is always released automatically after 30 minutes.

Q: The password was never entered incorrectly — why is the account locked?

A: Verification codes (OTP) are counted separately from passwords, and five consecutive code errors lock the account — far below the 20 allowed for passwords. An unsynchronized authenticator clock or repeated use of an expired email code can easily trigger the lock while the password is entirely correct. See Multi-Factor Authentication (MFA) Problems.

Q: Does resetting the password release an account lock?

A: Yes. The lock is released as soon as the password reset completes; there is no need to wait for the lock period to end. This also applies under the [Stricter] method, so contacting a Domain Superuser is not always necessary.

Q: What if the username or Domain name is forgotten?

A: The username of the administrator account is always admin. For other accounts, contact the Domain Superuser of the Domain. Both the password reset and the resend of a verification email require the Domain and the username; neither can be performed with the email address alone.

Q: Why is "Password is incorrect" shown even though the password is correct?

A: Verify the [Domain] field. The same username can exist in different Domains, and an incorrect Domain causes the password to be checked against a different account. Also confirm that Caps Lock is off.

Q: Why does the browser redirect to the password reset page right after login?

A: [Password Strength] is enabled for the Domain and the current password does not meet the requirement. Complete the password change to continue.

Q: Can an administrator view a user's password?

A: No. An administrator can only reset the password from the user detail page, and must enter their own password for identity verification during the process.