Introduction
Connectors can fail after enabling two-factor or multi-factor authentication on the source side because the stored credentials may no longer be enough to access the source system. In Kleene, this usually means the connector needs to be reauthenticated or updated to use an authentication method that supports the new security requirement.
This guide explains how to identify and resolve connector failures caused by newly enabled 2FA or MFA.
Issue description
A connector that previously worked may begin failing after adding two-factor authentication to the source account. The connector may still have the same username and password, but the source system may now require an additional authentication step, token, approval, or refreshed connection.
This can break scheduled extracts until the connector is reauthenticated.
Signs
You may be dealing with this issue if:
- A previously working connector suddenly starts failing.
- The failure begins after a security change.
- Recently enabled 2FA or MFA on the data source.
- Authentication errors appear even though the username and password are unchanged.
- Manual login now requires a second factor.
- Reauthenticating the connector resolves the issue.
Basic troubleshooting steps
Start with the following checks:
- Confirm whether 2FA or MFA was recently enabled on the source account.
- Confirm whether the account used by the connector now requires interactive login.
- Review the connector error for authentication or authorisation messages.
- Check whether the connector uses username/password, OAuth, API key, etc.
- Reauthenticate the connector where supported.
- Confirm whether a service account or API token should be used instead.
- Re-run the extract after authentication is refreshed.
Common causes and how to fix them
2FA added to the connector account
If the connector account now requires a second factor, scheduled extracts may fail because the connector cannot complete an interactive login challenge.
How to fix it: reauthenticate the connector using the supported flow. If scheduled access is required, consider using a service account or token-based authentication approved by the source system.
Token invalidated after security change
Enabling MFA or changing account security settings may invalidate existing tokens or sessions. The connector can then fail even if the original credentials are still correct.
How to fix it: refresh the connector authentication, reconnect the account, or generate a new token where required.
Authentication method no longer suitable
A username/password setup may no longer work after 2FA is enforced. Some systems require OAuth, app passwords, API keys, or service accounts for automated access.
How to fix it: confirm the supported authentication method for automated integrations and update the connector configuration accordingly.
Changed security policy
At source, there may be new conditional access rules, IP restrictions, SSO requirements or MFA policies that affect the connector account.
How to fix it: ask to confirm what changed and whether the connector account is allowed to authenticate from the Kleene environment.