Sign-in is refused: key expired or blocked, no second factor, too many codes

Driver with AUTH=KEY (personal key) or AUTH=WINDOWS against a service that knows keys, blocks, and a second factor, for example the data service Wkl.Data.Gateway. Access often shows only “ODBC–connection to … failed” (3151); other applications receive the service's message with SQLSTATE 28000.

The service has refused the sign-in. It tells the driver only the kind (not signed in, not authorized, too many attempts) and a short text; it records the exact cause in its log, where the service's support contact looks it up.

1. Find the message. If Access shows only 3151, get the text from the trace as described in Access shows only "ODBC--connection to … failed". Note down the time and the message.

2. Act on the message:

   Service message	What you do yourself	What you request from the support contact
   “Der persönliche Schlüssel ist unbekannt.” (The personal key is unknown.)	paste the key again instead of typing it (it starts with wkl_); check the driver's saved entry in Windows Credential Manager	a new key if it's still unknown
   “… ist abgelaufen.” / “… ist gesperrt.” (… has expired. / … is blocked.)	–	issue a new key; give the last four characters of your key and the time. You receive a one-time link; the new key replaces the old one in the connection or the saved entry
   “… ruht” (… is dormant) or refused outside an appointment (on-demand key)	–	activation for the hours of the appointment
   “Die Person … ist gesperrt.” (The person … is blocked.)	–	a review of the block; a blocked person is refused even with a Windows account
   Refusal pointing to a second factor that you don't have yet	– (the driver asks for a code but doesn't set up a factor)	a one-time link for the second factor: it shows the QR code for your authenticator app; after that, the driver asks for the code
   Second Factor dialog: “Der Code ist falsch oder wurde schon benutzt.” (The code is wrong or has already been used.)	wait for the next code (every 30 seconds) and enter it; check the phone's clock	–
   Refusal because of too many attempts (429)	wait, then sign in with a new code. How long is up to the service; the data service Wkl.Data.Gateway counts failed attempts with codes for 15 minutes	–
   Refused only when away, works in the office	–	a check whether your key is bound to networks or whether the sign-in policy blocks this location

3. Hand over to the support contact what you noted: time, message, your sign-in (name or last four characters of the key), location (office, home office, on the road). With the data service Wkl.Data.Gateway, the support contact uses this to find the cause in the administration application under Warum abgewiesen? (Why refused?) and fixes it there.

Connections that your application already has open remain until they're closed; after receiving a new key, refresh the links in Access or restart the application.

• Sign in with a personal key and a second factor
• Access shows only "ODBC--connection to … failed" (3151)
• Driver connection string