Skip to content

Admission Denied

URI: https://docs.ankatech.co/errors/admission-denied
HTTP Status: 403 Forbidden

When you see this

A federated login was refused because the presented identity resolved to no ANKASecure role for the tenant. Federated admission is deny-by-default: absence of a matching rule or mapping is a denial, never a default grant, so no account is provisioned and no token is issued.

Common Causes

  • No admission rule and no group-to-role mapping matched the identity's groups, email or derived email domain.
  • The provider carries at least one login domain guard and the identity's email domain is not derivable, or is not on that allowlist.
  • The identity asserted an email domain that is not a member of the deployment's applicable verified domain set.
  • The identity asserted an email claim the platform could not parse into a domain at all.

Response Example

{
  "type": "https://docs.ankatech.co/errors/admission-denied",
  "title": "Admission Denied",
  "status": 403,
  "detail": "Access denied: the presented identity is not mapped to any role for this tenant.",
  "instance": "/api/v3/admin/s2s/auth/idp/provision",
  "timestamp": 1730000000,
  "extensions": {
    "requestId": "550e8400-e29b-41d4-a716-446655440000"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

Every one of the causes above produces this byte-identical body, deliberately: the response is answered to an unauthenticated caller, so it must not disclose which rule, domain or mapping was missing. The distinguishing evidence is written to the admission-denial audit trail and the server log instead.

How to Resolve

  1. Read the admission-denial audit event for the tenant — it carries the reason (no-matching-admission-rule or domain-not-verified), whether a login domain guard was active, and how many rules and mappings were considered. The response body will not tell you.
  2. If the reason is a missing mapping, declare an admission rule or a group-to-role mapping that matches the identity, and confirm the role it names is assignable in this tenant.
  3. If the reason names the domain, declare the email domain as verified for the deployment, or add it to the provider's login domain guard — the two gates are ANDed and both must admit the identity.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.