RSA Product Set: SecurID
RSA Product/Service Type: Authentication Manager
RSA Version/Condition:  8.x

When attaching a replica instance to the RSA Authentication Manager 8.1 primary, the attach process fails and the replica does not come online.

Observable symptoms:

• The replica attach wizard shows Task Status: Failed at the Configuring replica instance and Starting Services step
• The following error appears in the replica setup log:

  Exception in thread "Main Thread" com.rsa.ims.security.keymanager.sys.SystemFingerprintException:
  The user name specified does not have a password assigned to it

NOTE: Where to find the log: appliance_setuplogs/install_logs/config/config.sh_Appliance_configureReplica_<yyyymmddhhmmss>.log on the replica appliance. The full stack trace is recorded in this log file. Only the key error lines are shown here for search purposes.

The username shown in the error message refers to the Operations Console account. The failure occurred while this account was attempting to extract and decrypt the ZIP file provided by the primary instance.

Part 1: Reset the Operations Console Administrative Account Password

1. Log in to the primary Security Console with an administrative account.
2. Navigate to Administration > Manage OC Administrators.
3. Click Change Password next to the Operations Console account referenced in the error.
4. Enter and confirm a new password. Make a note of it — you will need it in Part 2.

Part 2: Recover the Machine Fingerprint

5. Open an SSH session (or use the local console) and log in to the RSA Authentication Manager 8.x primary instance using the rsaadmin account.
6. Run the following command to recover the machine fingerprint, replacing the placeholders with the account credentials from Part 1:

   /opt/rsa/am/utils/rsautil manage-secrets -a recover -u <OC_admin_username> -p '<OC_admin_password>'

    Replace <OC_admin_username> with the Operations Console account User ID from Step 3, and <OC_admin_password> with the password set in Step 4.

   TIP: Wrap the password in single quotes to prevent special characters from being misinterpreted by the shell (e.g., -p 'MyP@ssw0rd!'). Alternatively, omit the -p flag entirely to be prompted for the password securely.

7. Confirm the command returns the following output:

   Machine fingerprint restored successfully.

Part 3: Generate a New Replica Package

8. Log in to the primary Operations Console using the Operations Console administrative account.
9. Navigate to Deployment Configuration > Instances > Generate Replica Package.
10. Click Download to download the new replica_package.zip file.

    NOTE: This newly generated replica_package.zip must be used for the replica attach process. The previously downloaded package is no longer valid and will cause the attach to fail again.

Part 4: Retry the Replica Attach Process

11. On the replica appliance local console, enter the replica URL (e.g., https://<replica_FQDN>) and the access code displayed on the local console.
12. Click the link to set up a replica and follow the configuration wizard using the new replica_package.zip.

Verify: Log in to the primary Operations Console and navigate to Deployment Configuration > Instances. Confirm that the replica instance appears with a status of Online.

If the issue persists after completing all steps, contact RSA Customer Support.