Your app is healthy. CPU looks normal. The network path is open. DNS resolves. Users still can't sign in. That combination usually sends new engineers toward the wrong layer first. They check firewalls, restart services, and compare certificates. Meanwhile, the core problem sits in identity metadata that nobody touched on purpose. That metadata is often…