Okta generates a system keyring error during client operations in Okta Advanced Server Access (ASA) or Okta Privileged Access (OPA) when the operating system keyring configuration changes or conflicts with the state file. Resolve this issue by unenrolling and re-enrolling the client to recreate the state file. When attempting to perform client operations, Okta displays the following error:

Error interacting with system keyring: data was encrypted with a different keyring configuration and cannot be decrypted

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Okta Advanced Server Access (ASA)
• Okta Privileged Access (OPA)

The error occurs because the Okta Advanced Server Access (ASA) or Okta Privileged Access (OPA) client encrypts the state.json file using the unique keyring of the operating system. If an administrator manually imports the state.json file from a different client or the operating system keyring changes, the client fails to decrypt the file.
 

How is the system keyring error resolved?

Unenroll and re-enroll the client using the command line interface to recreate the state file and resolve the encryption conflict.

1. Unenroll the client by running the following command:

sft unenroll

2. Re-enroll the client by running the following command:

sft enroll

Related References

• SFT Keyring ASA documentation
• SFT keyring OPA documentation