When they tried they would get an “incorrect login” error, even though we could login in succesfully to any other windows environment (we are using windows authentication)

So off to the log files we went and we noticed this gem:

   UpdateMetadata return code=807fe8f4....
   DoRequest return code=807fe8f4....
   The user does not have permission to perform this action.

Which according to this SAS Support article:

Usage Note 20381: The login might fail with a permission error

and states that the user does not have writemetadata permission on the Portal Application Tree, which means when they login the Portal cannot create a new folder in the metadata to hold their portal preferences.

Of course I would say that the error message that was displayed to the user was far from helpful, but as I was tightening metadata security before this started appearing then it all makes sense.

Thank SAS for the logs otherwise I think we would be chasing this one for a while.