Access
Two of the most common tickets — "I cannot sign in" and "I cannot see a product" — are both access problems, and both have a short list of causes.
"I cannot sign in"
Sign-in has three moving parts, and the symptom tells you which one.
| Symptom | Cause | What to check |
|---|---|---|
| Rejected at the identity provider | No account, or wrong password | The user exists in the identity provider. Commerce cannot fix a password |
| Signs in, then everything says unauthorised | Signed in but with no active session, so no customer is resolved | The user has an active session and a role on a customer |
| Signs in but sees nothing they expect | Active for a different customer than they mean | Which customer the active session names |
| Fails only from one site | The site's origin is not trusted | The origin is on the trusted list, exactly — scheme, host and port, no trailing slash |
The distinction worth internalising
Authentication and authorisation are separate steps here, and the second one uses the database.
Being signed in proves who someone is. Which customer they act for comes from an active session row, looked up per request — not from anything in the sign-in token. A user with no active session is authenticated and still cannot do anything, which reads to them as "the site is broken".
That is also why a user can belong to several customers without re-signing-in: switching customer changes a row, not a credential.
Revoking a session
The sessions screen lists active sessions and can revoke one, forcing that user to sign in again.
Useful when a user appears stuck in the wrong customer, or when access has been removed upstream and should take effect now rather than at expiry.
Sessions also expire on their own after a period of inactivity, sliding forward on each request.
"I cannot see a product"
Four causes, in the order worth checking.
Brand entitlement
The customer's allowed brands may not include the product's brand. A blank allowed-brands value means every brand — it is permissive, not restrictive, which surprises people.
Entitlement is applied inside the search query, so an excluded product is simply absent. There is no message and no error.
The product is blocked
A blocked product is hidden from every customer-facing query. It is a flag on the product, sent by the upstream push.
If nobody can see it, this is more likely than entitlement.
The search index is behind
Search runs against a separate index, refreshed every five minutes rather than on write. A product can exist and be correct and still not be findable yet.
Browse and direct lookup use the database, so if a product is reachable by browse but not by search, this is why. See Data and Search.
It was never pushed
The product may not be in Commerce at all. Check the back office before anything else — if it is absent there, the problem is upstream and no amount of cache clearing will help.
The quickest discriminator
Ask whether any customer can see it.
- Nobody can → blocked, not indexed, or never pushed
- Some can → entitlement, and the difference between those customers' allowed brands is your answer
Roles within a customer
What a user may do depends on a role held against the active customer, not on the user alone.
| Role | Can |
|---|---|
| Viewer | Browse, see the basket, see orders and account information |
| Purchaser | Everything a viewer can, plus change the basket and check out |
| Admin | Everything a purchaser can, plus manage that customer's own users |
So "they can see the basket but the checkout button does nothing" is usually a viewer who needs to be a purchaser — not a fault.
Roles are managed from the back office, and by the customer's own admin from the storefront.
Internal staff seeing everything
The client's own service staff hold a host-admin claim and are not scoped to a customer. They see across all of them by design.
Worth knowing when reproducing a fault: reproducing as internal staff will not reproduce a customer's entitlement problem. You have to reproduce as a user of that customer, or compare the two customers' configuration instead.