Installation & Administration
Diagnose setup, deployment and integration problems without exposing credentials or weakening production controls.
Review private PHP/web logs without showing stack traces publicly. Confirm config.php exists on hosting, syntax and required PHP capabilities, database connectivity and privileges, migration state and minimal file permissions. Keep production error display disabled. Stop after a migration error and compare the current schema and ordered release instructions before any retry.
For login, verify user activation and role, company lifecycle state, employee status, session/cookie behavior and HTTPS. For Microsoft Entra or SAML 2.0 enterprise sign-in, confirm the company entitlement, identity-provider configuration and current SSO policy. When SSO enforcement is active, an eligible existing tenant user is routed to the configured identity provider before local password verification; Super Admin remains outside tenant enforcement for controlled break-glass access. For missing invitations, verify invitation state, SMTP configuration, sender, port/encryption compatibility, spam filtering and safe mail diagnostics/private logs.
For SAML sign-in failures, confirm the CardIQ SAML runtime is enabled and validated for the correct company, the IdP uses the CardIQ SP metadata/entity ID and ACS URL, the configured IdP SSO URL is HTTPS, and the deployment-managed X.509 certificate matches the configured SHA-256 fingerprint when one is set. CardIQ requires the SP-initiated flow and correlates the response to the login request; unsolicited or IdP-initiated responses are rejected. The signed assertion must identify an existing active CardIQ user in that company. SAML does not perform JIT user creation or assign CardIQ roles, and SAML Single Logout is not supported. Before enabling enforcement after a material SAML configuration change, validate the runtime again and complete a successful pilot login.
For Entra preview/sync/reconciliation issues, confirm tenant configuration, selected allowlisted groups, Microsoft permissions, dry-run/review state, monitor-only versus auto-apply policy, scheduler execution and circuit-breaker/large-change safeguards. For SCIM Users provisioning, validate the tenant-scoped token, endpoint reachability, filter/pagination behavior, mapping/idempotency and deactivation/reactivation flow. SCIM provisioning is separate from SSO authentication. SCIM Groups and Bulk are not supported.
Confirm employee activation, company lifecycle, public-profile publication, slug and the QR/NFC destination. After deactivation, a stable link may resolve to a controlled inactive experience rather than disappear. For Wallet issuance, confirm lifecycle eligibility, provider configuration, valid HTTPS public URLs and private logs.
For API failures, verify the active scoped credential, authorization, company lifecycle and endpoint entitlement without logging full credentials. For webhook failures, confirm the HTTPS callback, signing value, receiving-server status, firewall/egress policy, retries and sanitized delivery logs. Before escalation, confirm public HTTPS, database reachability, SMTP, admin login, public profiles, QR generation, configured integrations, lifecycle enforcement, audit records and verified backups.
Explore the CardIQ Identity platform or review the workflow from verification through identity deactivation.
See how CardIQ Identity works View pricing