Known Error Database

Resolution

1. Review login events: Keycloak Admin Console → Events → Login Events, filter by user and 'LOGIN_ERROR'.
2. Check brute-force status: kcadm.sh get attack-detection/brute-force/users/$USER_ID -r $REALM
3. Unlock account: kcadm.sh update users/$USER_ID -r $REALM -s enabled=true
4. If external IP — enable realm brute-force detection policy, force password reset via kcadm.sh set-password -r $REALM --username $USER --new-password $TEMP_PASS --temporary
5. Clear active sessions: kcadm.sh delete users/$USER_ID/sessions -r $REALM

Resolution

Recycle the impacted application pool. If recycle fails, restart W3SVC. Validate health endpoint.

Resolution

1. Identify largest consumers: du -sh /var/lib/postgresql/*/main/pg_wal/ | sort -rh | head -5
2. If WAL archiving stuck: Check archive_command status, restart walreceiver.
3. Emergency space: SELECT pg_switch_wal(); then archive manually.
4. Prune: pg_archivecleanup /var/lib/postgresql/pg_wal <oldest_needed_wal>
5. If still > 90%: Add volume via LVM extend or move pg_wal to dedicated mount.
6. Validate: SELECT pg_is_in_recovery(); check replication lag.

Resolution

Identify long-running transactions (pg_stat_activity); kill idle-in-transaction over 10m; raise pool to runbook ceiling only with DBA approval.

Resolution

1. Create AD account with standard naming ($first.$last).
2. Assign laptop from inventory — image with standard SOE + role-specific apps.
3. Provision: GitHub org invite, Slack channels (per team), VPN profile (Cisco AnyConnect).
4. Request building access badge — submit to Facilities via ServiceNow RITM.
5. Send welcome email with Day-1 checklist, Wi-Fi SSID, IT contact.
6. Schedule 30-min IT orientation for first morning.

Resolution

1. Check AnyConnect client version — upgrade to latest stable if < 4.10.
2. Disable 'Allow local LAN access' if split-tunnel conflicts.
3. Set MTU to 1406: Preferences > VPN > Transport > MTU.
4. If on Wi-Fi: Switch to 5GHz band, disable power-saving for adapter.
5. Server-side: Check DTLS, ensure headend has sufficient license seats.

Resolution

1. Identify the service account (client_id) from error logs.
2. Check Keycloak Admin → Clients → <client> → Credentials tab for expiry.
3. Rotate client secret: iam_rotate_client_secret tool or KC Admin UI.
4. Update secret in consuming application's vault/config.
5. Verify: curl token endpoint with new credentials.
6. If using short-lived tokens: check token lifespan settings in KC realm.

Resolution

1. Pull login events: iam_get_login_events for the user (last 50).
2. Identify anomalous source IPs — cross-reference with known VPN/office ranges.
3. If confirmed unauthorized: iam_disable_user immediately.
4. Revoke all sessions: iam_revoke_sessions.
5. Force password reset: iam_reset_password (OOB email to verified address).
6. Check for lateral movement: review admin-events for role/group changes.
7. File security incident, escalate to SOC if data exfiltration suspected.