Attachment Access Denied / Unknown User

Symptoms

• Opening an attachment URL results in "AccessDenied" appearing in the URL bar
• The bottom-left user indicator in Cortex shows "Unknown User"
• The interface shows no access to any data sources

Cause

The Unknown User state indicates the session is no longer authenticated - typically a stale session cookie or expired SAML token. When Cortex can't identify the user, it can't verify data source access, which triggers an access denied response when loading attachments.

There is a known code-level issue where the attachment endpoint returns a 403 Forbidden response instead of a more descriptive error when a user is missing data source access. This causes an AccessDenied redirect that can be misleading. A fix is planned to replace that response with a clearer error message.

Resolution

Click the "Unknown User" link in the bottom-left of the interface. You'll be prompted to sign in via SAML. After re-authenticating, the issue should not recur.

If the problem comes back after signing in, check that your SAML session configuration isn't expiring too aggressively, and confirm the user account has the expected data source permissions assigned in Cortex.

Notes

• This has been observed to resolve persistently after a single re-authentication - it hasn't reproduced across different browsers, different users, or an IIS restart in the known case.
• If you see this error and the user account does have the correct data source access, a stale session is the most likely explanation.