Troubleshooting

This page covers the data service with its administration store and the administration app for Access (full version and Access Runtime, 32-bit and 64-bit). The service's messages appear on the sign-in card or in an app message exactly as the service words them, in German and without umlauts. This page quotes each message verbatim, followed by an English translation.

What the user sees states only the kind of rejection (not signed in, not permitted, too many requests). The service records the actual cause in its log, and the administration app spells it out in plain language:

1. Open the Personen und Schlüssel (People and keys) area and select the person.
2. Choose Zugang wiederherstellen … (Restore access …), also available on the list's shortcut menu. To the right of the list, you see this person's last 20 rejections, newest first: the time (UTC), the sign-in (key ID or account), the cause, what helps, and the request.
3. Select a row and choose Beheben … (Fix …). Depending on the cause, the app reissues the key, activates it, enables the person's account again, opens Regeln zuordnen (Assign rules) or Anmeldung und Rechte (Sign-in and rights), or sets up the second factor, each time with the same confirmation prompt as the command of the same name. If the fix is up to the user (entering a code, waiting), the app tells you so instead of changing anything.

If you select a different person in the list, the view shows that person's rejections.

Limits: The view goes back as far as the service keeps its log (Read the log and sessions, Notes), so older rejections are missing. A rejection shows up under a person only if the service could identify that person through one of their keys, their Windows account, or their SQL login. A sign-in that isn't linked to any person appears only under Protokoll (Log) > Audit.

Cause: a typo, a key from a different service, or the service doesn't accept personal keys (AuthMode without PersonalKey).

Fix: Paste the key again instead of typing it (it's 53 characters long and starts with wkl_). If that doesn't help, issue a new key.

(… has expired. / … has been revoked. / The person this key belongs to is locked. / The person this sign-in belongs to is locked.)

Cause: The key has reached its expiration date or has been revoked, or the person has been disabled. A person whose account is disabled is also rejected when signing in with their Windows account or SQL login.

Fix: Issue a new key or enable the person's account again; see Revoke a key or lock a person. A revocation can't be undone.

Cause: The address on the sign-in card starts with http:// and points to another computer. Administration responds only over a secure connection.

Fix: Enter the service's HTTPS address. If the service sits behind a proxy, the proxy has to be registered as trusted in the configuration and has to send X-Forwarded-Proto: https.

Cause: The person doesn't have a rule with the admin right, their rule is read-only and they tried to change something, or the key is restricted to particular data sources.

Fix: Another administrator gives the person the verwaltung rule (see Create a person and issue a key) or issues a key that isn't restricted to data sources.

Cause: a wrong code, a code that was just used, or a phone whose clock is off.

Fix: Wait for the next code (they change every 30 seconds) and enter it. Set the phone to get its time automatically. If the entry in the authenticator app no longer matches the service (the app was reinstalled or the phone replaced), set up the second factor again; see Set up or reset the second factor.

Cause: five wrong codes for one person, or twenty from the same origin (address), within 15 minutes. The service then accepts no codes for up to 15 minutes, not even correct ones.

Fix: Wait up to 15 minutes, then enter the current code.

Cause: The sign-in policy requires a second factor, but the sign-in can't be linked to a person (a Windows account that's authorized only through a group), or the person has no second factor.

Fix: Create a person with that Windows account in the Windows-Konto (Windows account) field, or set up a second factor for the person; see Set up or reset the second factor.

Cause: A sign-in rule with the effect Deny matches the sign-in method and the network.

Fix: Sign in from an allowed network or adjust the rule; see Define the sign-in policy. If nobody can sign in to administration anymore, follow Regain access when administration is locked out (data service documentation).

Cause: After every change, the service validates its entire contents. If a change would leave them invalid (a rule names an unknown data source, a person names an unknown rule, a Windows name doesn't exist), the service rolls the change back completely and states the reason.

Fix: Resolve the reason given, for example by creating the data source first and then the rule.

Cause: Another administrator changed the same entry after your list or form read it.

Fix: Discard your change in the form with Esc, choose Aktualisieren (Refresh) at the right end of the command bar, and make the change again.

The Datenquellen gestört (Data sources with problems) card counts every active data source whose check fails. The Gestörte Datenquellen (Data sources with problems) list below it gives the cause for each one in a few words, such as Datenbankserver nicht erreicht (Database server not reached), Anmeldung abgewiesen (Login refused), or Datenbank auf dem Server nicht lesbar (Database not readable on the server; next section). If none has a problem, it reads Alle aktiven Datenquellen sind erreichbar. (All active data sources are reachable.)

Cause: SQL Server can't be reached, the login in the connection string is rejected, or the database is missing.

Fix: Double-click the data source in the list; the Datenquellen (Data sources) area opens with it selected. Choose Verbindung prüfen (Test connection); the message shows the cause, the next step, and the error from SQL Server. Correct the connection string; see Connect a data source.

Cause: SQL Server is running but can't read the database: the drive holding its files was briefly unavailable (an external disk, for example), or the database is offline or damaged. After a drive drops out, this persists until the Windows service of the SQL Server instance (for example, “SQL Server (MSSQLSERVER)”) is restarted, even if the drive came back long ago. This is SQL Server behavior observed with an external disk, not something Microsoft guarantees. In this case, SQL Server reports error 823 (Microsoft: “MSSQLSERVER_823,” https://learn.microsoft.com/sql/relational-databases/errors-events/mssqlserver-823-database-engine-error).

The overview shows the data source as “nicht lesbar” (the server responds, but the database doesn't), and Verbindung prüfen shows the SQL Server error until SQL Server has been restarted. If SQL Server still answers the check from its memory, the check reports the time of the last error, for up to 10 minutes afterward. In Warum abgewiesen?, the error appears as “Die Datenbank ist auf dem Server nicht lesbar” (The database can't be read on the server).

Fix: On the server, make sure the drive is there, then restart the Windows service of the SQL Server instance; this interrupts all connections to that instance. Then choose Verbindung prüfen. Running DBCC CHECKDB, as the SQL Server message suggests, doesn't help after a lost drive; it's only appropriate if the error persists after the restart.

Cause: The service caches a database's structure for 5 minutes.

Fix: Wait, or in the Datenquellen area choose Weitere > Katalog neu laden (Reload catalog). If it's still missing, the user's rule lacks the object type (tables, views), or the data source's login lacks the permission in SQL Server.

Cause: The service's master key doesn't match the stored values; the message at startup names every affected data source. This concerns running the data service, not this app.

Fix: The service's operator follows the steps in Change the master key (data service documentation).

Cause: The starter reports this with error code 21 and doesn't open the app. This delivery contains the edition for 32-bit Office (dbgwmgr_x86.accde, dbgwmgr_x86.accdr), and the workstation has 64-bit Access installed.

Solution: 64-bit Office needs its own edition (dbgwmgr_x64.accde/.accdr); ask the manufacturer for it. Details on the code: The version of the application does not match the installed Access (32 or 64 bit) (code 21) (WKL Bootstrapper documentation).

• Administrator guide for WKL Database Gateway Manager
• Reference: every response from the service in HTTP: sign-in (reference), HTTP: native API (reference), and HTTP: administration (reference); troubleshooting for developers under Troubleshooting (all in the data service documentation)