---
updatedAt: 2026-02-11T19:17:55.000Z
---

# Troubleshoot Authentication Issues | BI Cloud

## Active Directory user cannot authenticate with BeyondInsight or Password Safe

If an Active Directory user is a member of more than 120 Active Directory groups, the user may encounter the following error when attempting to log in to the BeyondInsight management console, Analytics & Reporting, or Password Safe, although correct credentials were supplied:

* Authentication fails with *The username or password is incorrect. Please try again*.
* An error is logged in the **frontend.txt** file associated with that login attempt, that includes *A local error occurred*.

The user cannot authenticate because the Kerberos token that is generated during authentication attempts has a fixed maximum size. To correct this issue, you can increase the maximum size in the registry.

1. Start the registry editor on the BeyondInsight server.
2. Locate and click the following registry subkey:

   HKEY\_LOCAL\_MACHINE\System\CurrentControlSet\Control\Lsa\ Kerberos\Parameters

> ℹ️
>
> If the **Parameters** key does not exist, create it now.

1. From the **Edit** menu, select **New**, and then select **DWORD Value**, or **DWORD (32-bit) Value**.
2. Type **MaxPacketSize**, and then press **Enter**.
3. Double-click **MaxPacketSize**, type **1** in the **Value** box, select **Decimal**, and then click **OK**.
4. From the **Edit** menu, select **New**, and then click **DWORD Value**, or **DWORD (32-bit) Value**.
5. Type **MaxTokenSize**, and then press **Enter**.
6. Double-click **MaxTokenSize**, type **65535** in the **Value** box, select **Decimal**, and then click **OK**.
7. Close the registry editor, and then restart the BeyondInsight server.

> ℹ️
>
> For more information, see [Problems with Kerberos authentication when a user belongs to many groups](https://docs.microsoft.com/en-US/troubleshoot/windows-server/windows-security/kerberos-authentication-problems-if-user-belongs-to-groups).

## Authentication errors when using SAML 2.0 web applications

> ℹ️
>
> Both Runtime Error and Internal Server Error are for on-premises Password Safe deployments only. If an error shown below occurs using Password Safe Cloud, contact BeyondTrust Technical Support.

### Runtime error

If you receive a Runtime Error, add the following to the **web.config** file:

Set mode to Off < customErrors mode="Off" />

This provides an actual error.

### Internal server error (500)

An *Internal Server Error (500)* message usually indicates that the **web.config** file is not formatted correctly.

1. Open **IIS** on the U-Series Appliance.
2. Browse to the SAML website, and then double-click **Default Document**.
3. If there is a formatting error in the **web.config** file, an error displays, indicating the line number for the error.