Troubleshoot Sign-in Issues

Follow these instructions if you can’t sign in to Cobalt because:

• You have problems with two-factor authentication (2FA):
  • You lost access to your authenticator.
  • One-time codes don’t work.
  • “Remember this device” option doesn’t work.
• You forgot your password.
• We don’t recognize your device.
• You have problems with SAML SSO.
• You are locked out of your account.
• You believe your account was compromised.

Problems with Two-Factor Authentication

Lost Access to Your Authenticator

Users in the following roles can ask an Organization Owner to turn off two-factor authentication (2FA) for their account:

• Organization Owner
• Organization Member
• Pentest Team Member

If you’re the only Organization Owner, we’ll turn off 2FA for you upon your request. Follow the steps below.

To request to turn off 2FA:

1. Sign in to Cobalt from the Sign In page in one of the following ways:
   • With your username and password
   • By selecting Sign in with Google
2. On the page prompting you to enter a one-time code, select Start account recovery process.
   
   
3. Once you get an email with a one-time identity verification code, enter the code, and select Verify.
4. Your Organization Owner gets notified and turns off 2FA for your account.
   • If you’re the only Organization Owner, we’ll turn off 2FA for you.
5. You get an email notification confirming that your 2FA settings were updated.
6. You can now sign in without a second authentication factor.
   • If your organization enforces 2FA, enable it upon signing in.

Once you’ve set up a new authenticator, you can turn on 2FA again.

Turn Off 2FA for a User

As an Organization Owner, you can turn off two-factor authentication for a user following their request.

1. Once you get an email notification requesting you to turn off 2FA, select Recover Account in the email.
2. On the People page of your dashboard, locate the user who submitted the request.
3. Select the three-dot icon on the right, and then select Turn Off 2FA.
   • We verified the user’s identity with a one-time verification code. However, we recommend that you verify their identity again before turning off 2FA.
     
4. Select Confirm in the overlay that appears.

One-Time Codes Don’t Work

One-time codes that your authenticator app generates are time-based. If the codes that you enter when signing in are invalid, do the following:

• Enter the code promptly, within 30 seconds as it appears in the authenticator app.
• Make sure the time is synchronized between the devices. If you manually changed the time zone on your mobile device earlier, select the system time zone.

“Remember This Device” Doesn’t Work

When you sign in to Cobalt using 2FA, you can select Remember this device for 30 days. This option works for a specific device and browser.

You need to enter a one-time code from your authenticator if:

• You’re using a different device or browser.
• You cleared cookies from your browser, or you haven’t enabled them.
• You’re browsing in incognito mode.
• You’re using a different internet connection.
• Another user signed in on the same device using the same browser.

Forgot Your Password

To reset your password:

1. On the Sign In page, select Forgot password?.
2. Enter your email address that you used to sign in to Cobalt, and select Reset Password.
3. Follow the instructions in the email you receive.

We Don’t Recognize Your Device

When you sign in to Cobalt, we record information about your device to add an extra layer of security to the sign-in process.

If you attempt to sign in from a device that we don’t recognize, we take additional steps to verify your identity before granting you access. This may happen when you:

• Sign in from a new browser
• Use your browser’s private (incognito) mode
• Clear your site data
• Sign in from a different system

When you see the Verify It’s You message upon signing in, do the following:

1. Check your email that you used to sign in to Cobalt.
2. In the email prompting you to verify your device, double-check the details of your last sign-in attempt, and select Verify Device.
   • If you don’t recognize this sign-in attempt, do the following:
     • Contact your Customer Success Manager (CSM) or support@cobalt.io. We’ll temporarily lock your account and open an investigation.
     • Change your password, and reset two-factor authentication.
   • Make sure to verify your device before the link in the email expires.
3. We save the device information and sign you in to the Cobalt app.
   • You get an email confirming that we verified your new device.
   • Next time you sign in from this device, you don’t need to verify it again.

To enhance your account security, we recommend that you enable two-factor authentication.

Can’t Sign In Using SAML SSO

If your organization has enabled SAML SSO, sign in from the identity provider system, such as Okta or OneLogin. You can’t sign in from the Cobalt Sign In page.

• If you don’t know what identity provider your organization uses, contact your Organization Owner.
• If you don’t see the Cobalt app within your identity provider, contact your IdP admin. They’ll add Cobalt to your IdP account.
• Ensure that you’re a provisioned user both in the IdP system and Cobalt. Complete the account setup process for Cobalt, which includes confirming your email address and creating a password. The email address for your IdP and Cobalt must match.
• As an Organization Owner, ensure that your SAML SSO configuration is correct.

Locked Out of Your Account

If you make several unsuccessful attempts to sign in, we’ll temporarily lock your account.

To unlock your account, follow the instructions in the email that you receive. If you still can’t sign in, contact us at support@cobalt.io.

Account Was Compromised

If you believe your account was compromised, reach out to your Customer Success Manager (CSM) or support@cobalt.io. We’ll temporarily lock your account and open an investigation.

If you have access to your Cobalt account, do the following:

1. Change your password.
2. Reset two-factor authentication.

Error Messages upon Signing In

Here are the most common error messages you may see upon signing in to Cobalt.