Advanced Server Access (ASA) / Okta Privileged Access (OPA) client is having various operations fail with the error:

Error interacting with system keyring: data was encrypted with a different keyring configuration and cannot be decrypted

• Advanced Server Access (ASA)
• Okta Privileged Access (OPA)

ASA/OPA internally creates a state.json file on the client that includes tokens. Starting in ASA client 1.77.0, by default, this is encrypted by the unique keyring of that client's Operating System (OS). This results in only the client's keyring being able to decrypt the state.json file. If there are discrepancies in the encryption status (for example, state.json was manually imported from a different client) or changes to the keyring on the OS side, the client may have issues decrypting the state.json file, resulting in this error.
 

Re-enrolling the client may resolve the issue, as this will re-create the state.json, which should now have no conflicts regarding the encryption status.

1. Unenroll the client: sft unenroll
2. Re-enroll the client: sft enroll

Related References

• More details about SFT's usage of keyring can be found in SFT Keyring ASA documentation or in SFT keyring OPA documentation