OneLogin - User Authentication Conflict Due to Account Source (4383167)

A user in the tenant environment could not be unlocked or properly authenticated. The account was being directed to authenticate through Active Directory, but authentication was failing and preventing access.

The issue was caused by an inconsistency between the account source and authentication configuration:

• The user account was created directly in OneLogin
• The account was later linked to a cloud directory
• A mapping rule required users with a specific email domain to authenticate through Active Directory
• The user was not synced from Active Directory and had no valid connection to it
• The Active Directory Connector was unavailable

This resulted in a conflict where the user was forced to authenticate through a directory they were not associated with.

To resolve the issue, one of the following actions was applied:

• Restore the Active Directory Connector service in the environment
• Recreate the user account from Active Directory so that sync and authentication align properly

Alternative solution:

• Modify or disable the mapping rule enforcing Active Directory authentication for this user
• Allow the user to authenticate directly through OneLogin where appropriate