Appearance
Portal error codes
The codes behind the portal's error messages, what each means, and who fixes it.
What a guest sees
The captive portal fails in two different ways, and they look different on screen:
- Full-page errors — raised before a guest ever reaches a login form (bad session, unknown controller, expired licence, maintenance, blocked device, too many requests). The portal is replaced by an error page with an icon, a short title and a guest-friendly hint. For the codes marked Troubleshoot link below, the page also offers a "Troubleshoot this error" link to the public support page.
- Inline errors — shown while a guest is filling in a login or registration form. The message appears next to the form or as a pop-up; the page itself doesn't reload.
Guests never see the code itself — only the message. The code is shown, as a small badge under the message, when you open the portal through Portal Simulation; full-page errors there also show a technical line with the exact value that failed (for example the licence expiry date). To find out which code a guest hit, reproduce their visit in Portal Simulation.
Full-page codes (raised before login, on the error page):
| Code | What it means | Troubleshoot link |
|---|---|---|
NO_CONTROLLER_ID | The portal was opened without a controller identity — the guest didn't arrive through a proper captive-portal redirect from the controller. | Yes |
NAS_NOT_CONFIGURED | The controller identity (NAS-Identifier) sent by the access point or gateway doesn't match any Device Controller in Kiwire. | Yes |
TENANT_NOT_FOUND | The controller is registered, but to a site that no longer exists. | Yes |
SYSTEM_MAINTENANCE | The whole platform is in maintenance. | No |
TENANT_MAINTENANCE | Your site is in maintenance. | No |
TENANT_INACTIVE | Your site has been switched off by the platform. | No |
LICENSE_MISSING | Your site's licence can't be read (an organisation set up by Synchroweb whose key has not been fetched yet). Organisations that signed up themselves on the Free plan don't see this. | Yes |
LICENSE_EXPIRED | Your site's licence has expired — see below. | Yes |
DEVICE_LIMIT_EXCEEDED | You have more controllers than your licence allows. | Yes |
LOGIN_LIMIT_EXCEEDED | Your site has used its full monthly login allowance from the licence. | No |
DEVICE_BLOCKED | The guest's MAC or IP address matches a block rule on the Firewall Policy page (site-wide or for this controller). | Yes |
invalid_mac | The controller didn't send a usable device MAC address. | Yes |
SESSION_MISSING | The portal session was never started, or the guest's browser lost it — see "Session expired" below. | Yes |
SESSION_EXPIRED | The guest was idle too long — see "Session expired" below. | Yes |
NO_PAGE_ALLOCATED | No portal page is assigned for this guest: the zone, journey and default page together came up empty. | Yes |
PAGE_NOT_FOUND | The page assigned to this guest isn't published (or was deleted). | Yes |
RATE_LIMIT | The device made too many requests in a minute (opening the portal 10 times, loading pages 30 times, or submitting the login form 5 times — counted per device, or per IP address when the MAC is unknown). It clears by itself after a minute. | Yes |
Inline codes — reasons a login or registration attempt fails, in the order Kiwire checks them. The first check that fails is the only one the guest sees; nothing later in the list is checked.
| Code | Meaning |
|---|---|
INVALID_CREDENTIALS | Unknown username, or wrong password — the same message either way, so nobody can find out which usernames exist. |
ACCOUNT_LOCKED | Too many wrong passwords — see "Locked accounts" below. Checked once the username is found, before the password, so even the right password is refused while the lock lasts. |
TENANT_CAPACITY_REACHED | Your site's limit on guests online at the same time has been reached. |
LOGIN_QUOTA_REACHED | The same monthly licence allowance as LOGIN_LIMIT_EXCEEDED above, checked again at each login attempt. |
ACCOUNT_SUSPENDED / ACCOUNT_EXPIRED / ACCOUNT_INACTIVE | The account's status isn't Active. |
| (general "not allowed" message) | The account's profile has a time restriction that doesn't allow sign-in right now. |
FUTURE_VALUE_DATE | The account's start date is still in the future. |
ACCOUNT_EXPIRED | The account's expiry date has passed. |
| (general "not allowed" message) | An external policy check connected to your site rejected the login. |
ZONE_ACCESS_DENIED | The account is limited to certain zones and the guest is in a different one — see "Tenant or zone not found" below. |
ZONE_CAPACITY_REACHED | The zone's limit on guests online at the same time has been reached. |
MAC_NOT_ALLOWED | The account has an allowed-MAC list and this device isn't on it. |
TIME_LIMIT_REACHED | A time-based profile's allowance is used up. |
QUOTA_LIMIT_REACHED | A data-quota profile's allowance is used up. |
MAX_SIMULTANEOUS_REACHED | The account's own limit on devices online at the same time is full. |
Locked accounts
ACCOUNT_LOCKED appears in two cases:
- Password Policy lockout. When Enable Password Policy is on (the Password Policy card on System › Settings), an account is locked after a number of wrong passwords in a row — Lock user after failed attempts, 7 when left blank, 0 turns locking off. The lock lasts for Lockout duration (minutes) — 24 hours when left blank.
- Too many wrong passwords in an hour. After 100 wrong passwords for the same username within an hour, that username is refused until the hour is up, whether or not the Password Policy is on.
Either way the lock ends by itself when the time is up, and the account's status is not changed. There is no button to unlock an account early — the guest has to wait, or you can give them a different account in the meantime.
LICENSE_EXPIRED
Raised when your site's licence has an expiry date in the past.
- Guest-facing hint: "The service license has expired. Please contact your administrator to renew." In Portal Simulation the technical line also shows the exact expiry date.
- Fix: contact Synchroweb to renew the licence.
- Related codes from the same licence check, in the order they are checked:
LICENSE_MISSING(the licence can't be read at all),DEVICE_LIMIT_EXCEEDED(too many controllers for the licensed device count),LOGIN_LIMIT_EXCEEDED(monthly login allowance used up).
Tenant or zone not found
Three different failures all mean "Kiwire couldn't place this guest":
NAS_NOT_CONFIGURED— the identity the controller sends doesn't match any controller on System › Device Controller. Fix: add the controller, with its Identity exactly as the controller sends it (see Identity and Virtual NAS).TENANT_NOT_FOUND— the controller is registered, but to a site that no longer exists. Contact Synchroweb.ZONE_ACCESS_DENIED(inline, not full-page) — the account is limited to certain zones and the guest's current zone isn't one of them. If the guest's current zone isn't one Kiwire recognises, the login is let through rather than refused, so a misconfigured zone doesn't strand guests. An account with no zone restriction is never refused for this reason.
Session expired
SESSION_MISSING— the portal page loaded without a portal session. Either the guest didn't arrive through the controller's redirect, or their browser dropped the session between the redirect and the page (check the controller's redirect URL — see Redirect and login settings).SESSION_EXPIRED— the guest left the portal open with no activity for longer than the idle timeout (30 minutes, set by the platform). The guest has to reconnect to the Wi-Fi to start again.
Login method unavailable
Codes returned when the login method itself is broken or switched off, rather than the guest's credentials. They are worded generally to the guest because the real cause is a setting on your side:
| Code | Guest sees | Real cause |
|---|---|---|
METHOD_NOT_SELECTED | "Please select a login method to continue." | The form was sent with no method chosen. |
METHOD_UNAVAILABLE | "This login option is currently unavailable." | The method is set up but switched off or misconfigured for this zone or journey. |
METHOD_NOT_SUPPORTED | "This login method is not yet available." | The method can't be used on this kind of page. |
PORTAL_NOT_CONFIGURED | "This login option is not set up correctly." | A required setting on the login method is missing. |
NO_PROFILE_CONFIGURED | "No profile assigned." | The login method has no profile to give a new account, so the account can't be created. |
SHARED_NOT_CONFIGURED | "This login option is not ready yet." | A shared-account login method has no account chosen. |
SHARED_NOT_FOUND | "This login option is not properly set up." | The shared account it points to doesn't exist. |
SHARED_NOT_ACTIVE | "This login option is currently disabled." | The shared account exists but isn't active. |
DEVICE_NOT_IDENTIFIED | "We could not identify your device." | The controller didn't send a usable MAC address with this login attempt. |
The Active Directory, LDAP and External Database methods show "This login option is not set up correctly." with their own codes: DIRECTORY_CONNECTOR_UNAVAILABLE (the method points at the wrong kind of connector), DATABASE_CONNECTOR_UNAVAILABLE (the Database connector is missing or switched off) and DATABASE_UNAVAILABLE (the database could not be reached or the table and columns on the method are wrong). DATABASE_NO_PROFILE and QR_NO_PROFILE mean the External Database or QR Login method has no profile.
All of these are fixed from the admin side: check the login method's settings on the journey or page, not the guest's account.