Unable to load bean named CTKIPServerService when importing a token via CTKIP to RSA SecurID Software Token
2 months ago
Originally Published: 2015-06-10
Article Number
000062867
Applies To
RSA Product Set: SecurID
RSA Product/Service Type: Authentication Manager
RSA Version/Condition: 8.x
Issue
Users are unable to import a software token to their RSA SecurID Software Token application via CT-KIP distribution. Users will most likely get the following error on their device:
 
Error communicating with server.
Token Import Failed

The System Activity Monitor will likely show the following error: 
Administrator "SYSTEM" attempted to execute command 
"com.rsa.authmgr.internal.ctkip.command.ProcessCTKIPClientRequestCommand"
Activity Result Key: Failure
With the exception : 
com.rsa.ims.components.ComponentFailureException: Unable to load bean named CTKIPServerService

The software token imports successfully via file-based distribution and CTF distribution. The issue may appear in the environment where the data was migrated from RSA Authentication Manager 7.1.
Cause
The cause for this error is possibly because the RSA Authentication Manager 7.1 system was promoted at some point which may have broken the CT-KIP key store. The fix is to reinstall the CT-KIP key store.
Resolution
  1. Before starting, locate your RSA Authentication Manager 8.x license files. Do not proceed without the license files.
  2. Create a backup of the database using Backup Now.  
  3. Login to the RSA Authentication Manager primary using the steps in 000064878-How to SSH to an RSA Authentication Manager version 8.x server
  4. Get the database password.  Note that the password string will be different for each deployment of RSA Authentication Manager.
rsaadmin@am84p:> /opt/rsa/am/utils/rsautil manage-secrets -a get com.rsa.db.dba.password 
Please enter OC Administrator username: <enter Operations Console administrator name>
Please enter OC Administrator password: <enter Operations Console administrator password>
com.rsa.db.dba.password: ckg2DBtNZLy80TADWcGqdF0NOJygAQ
  1. Access the database using the database password:
rsaadmin@am84p:> /opt/rsa/am/pgsql/bin/psql -h localhost -p 7050 -d db -U rsa_dba
Password for user rsa_dba: <enter the password from step 4 above>
  1. Run the following command:
DELETE FROM rsa_rep.ims_config_value WHERE name LIKE '%ctkip.service.keystore%';
  1. Within the license.zip file there are files named defaultRSAToolbar.cer and defaultRSAToolbar.key.
  2. Using WinSCP or a similar tool, copy these files to the /tmp directory on the primary appliance.
  3. From an SSH session to the RSA Authentication Manager primary, navigate to the utils directory:
cd /opt/rsa/am/utils
  1. Run the following command
./rsautil install-ctkip-keystore -l /tmp -k defaultRSAToolbar.key -c defaultRSAToolbar.cer -a <oc admin username>
  1. Try importing the token via CT-KIP again.

Related Articles

Trending Articles

Don't see what you're looking for?