Root Cause Analysis
On September 14, 2026, from approximately 06:35 UTC until 08:00 UTC, some customers hosted in the RSA ID Plus EU2 environment experienced degraded authentication service. During this period, some authentication requests were delayed or failed to complete. Impact varied by customer and authentication flow. The service recovered without intervention as morning traffic levels settled.
What Happened
As authentication activity increased, a flaw in the service’s work-distribution algorithm repeatedly reassigned work among service components. Each reassignment added activity elsewhere and prompted further reassignment, creating a cycle that degraded authentication processing. Some user provisioning and directory-related requests were also affected.
Root Cause
The root cause was a defect in the algorithm the service uses to distribute work. Under changing processing conditions, the algorithm did not keep work assignments stable; instead, it repeatedly reassigned work and amplified activity across the environment. This cascading behavior—not increased activity alone—caused the authentication delays and failures.
Resolution
Service performance recovered as activity decreased and the environment stabilized. Engineering confirmed that latency and error rates had returned to normal levels and continued monitoring the service.
No customer action or configuration changes are required.
Why Disaster Recovery Was Not Activated
The EU2 environment remained partially operational and did not meet the criteria for regional failover. Because the issue involved how work was distributed within the service, moving traffic to the recovery region was not expected to resolve it and could have introduced additional disruption while the service was stabilizing.
Corrective Actions
RSA is pursuing the following improvements to reduce the likelihood and impact of similar events:
- Tenant-work routing: Changes to how work is redistributed within the authentication service tier under load, to prevent repeated redistribution cycles.
- Runtime behavior: Analysis of memory management telemetry to determine whether further tuning is warranted.
- Detection: Improved monitoring and alerting so this pattern is identified earlier.