Unable to load bean named CTKIPServerService when importing a token via CTKIP to RSA SecurID Software Token

[#1]

Article Number

000030474

Applies To

RSA Product Set: SecurID
RSA Product/Service Type: Authentication Manager
RSA Version/Condition: 8.x

Issue

Users are unable to import a software token to their RSA SecurID Software Token application via CT-KIP distribution. Users will most likely get the following error on their device:
 

Error communicating with server.
Token Import Failed

The System Activity Monitor will likely show the following error:

Administrator "SYSTEM" attempted to execute command 
"com.rsa.authmgr.internal.ctkip.command.ProcessCTKIPClientRequestCommand"
Activity Result Key: Failure

With the exception :

com.rsa.ims.components.ComponentFailureException: Unable to load bean named CTKIPServerService

The software token imports successfully via file-based distribution and CTF distribution. The issue may appear in the environment where the data was migrated from RSA Authentication Manager 7.1.

Cause

The cause for this error is possibly because the RSA Authentication Manager 7.1 system was promoted at some point which may have broken the CT-KIP key store. The fix is to reinstall the CT-KIP key store.

Resolution

1. Before starting, locate your RSA Authentication Manager 8.x license files. Do not proceed without the license files.
2. Create a backup of the database using Backup Now.  
3. Login to the RSA Authentication Manager primary using the steps in 000038244 - How to SSH to an RSA Authentication Manager server  
4. Get the database password.  Note that the password string will be different for each deployment of RSA Authentication Manager.

rsaadmin@am84p:> /opt/rsa/am/utils/rsautil manage-secrets -a get com.rsa.db.dba.password 
Please enter OC Administrator username: <enter Operations Console administrator name>
Please enter OC Administrator password: <enter Operations Console administrator password>
com.rsa.db.dba.password: ckg2DBtNZLy80TADWcGqdF0NOJygAQ

5. Access the database using the database password:

rsaadmin@am84p:> /opt/rsa/am/pgsql/bin/psql -h localhost -p 7050 -d db -U rsa_dba
Password for user rsa_dba: <enter the password from step 4 above>

6. Run the following command:

DELETE FROM rsa_rep.ims_config_value WHERE name LIKE '%ctkip.service.keystore%';

7. Within the license.zip file there are files named defaultRSAToolbar.cer and defaultRSAToolbar.key.
8. Using WinSCP or a similar tool, copy these files to the /tmp directory on the primary appliance.
9. From an SSH session to the RSA Authentication Manager primary, navigate to the utils directory:

cd /opt/rsa/am/utils

10. Run the following command

./rsautil install-ctkip-keystore -l /tmp -k defaultRSAToolbar.key -c defaultRSAToolbar.cer -a <oc admin username>

11. Try importing the token via CT-KIP again.