Gateway Error when Enrolling
Last Updated:
Overview
Gateway unable to get enrolled and shows the following errors in system log:
Aug 29 19:13:44 gateway sft-gatewayd[723]: 2024-08-29T19:13:44.284Z DEBUG disconnected enabled? {"config": false, "hasLastSync": true, "hasOfflineTrusts": false}
Aug 29 19:13:44 gateway sft-gatewayd[723]: 2024-08-29T19:13:44.284Z ERROR Platform configuration failed {"error": "error fetching token source: oauth2: cannot fetch token: 404 Not Found\nResponse: {\n \"type\": \"resource_does_not_exist\",\n \"code\": 404,\n \"message\": \"Client ID not found\"\n}\n"} Aug 29 19:13:44 gateway sft-gatewayd[723]: 2024-08-29T19:13:44.284Z DEBUG transitioning to state 0
Aug 29 19:13:44 gateway sft-gatewayd[723]: 2024-08-29T19:13:44.284Z ERROR Service entering failed state, shutting down
Aug 29 19:13:44 gateway sft-gatewayd[723]: 2024-08-29T19:13:44.284Z ERROR sft-gatewayd service failed, automatically retrying {"version": "1.83.1", "retry_in": "10m45.703245684s"}
Applies To
- Advanced Server Access (ASA)
- Okta Privileged Access (OPA)
- Gateway
Cause
The gateway had stale data from a previous enrollment under /var/lib/sft-gatewayd. It can happen when gateway was deleted from UI OR when the image used for gateway already had files from previous enrollment. In this case, when the sft-gatewayd service starts, it will use the old data to connect to the team, which results in a failure. The location /var/lib/sft-gatewayd needs to be cleaned to re-enroll the gateway.
Solution
It is recommended to uninstall and install the gateway service again. However if the service has been installed recently then only stopping the service can help. Below steps can be followed to clean up the files:
- Stop Gateway service (skip this step if service has been re-installed already):
sudo systemctl stop sft-gatewayd - Remove data from previous enrollment:
sudo rm -rf /var/lib/sft-gatewayd - Restart the service. This will re-enroll gateway using the token* and create all the needed files in the same location
sudo systemctl restart sft-gatewayd
*The /etc/sft/sft-gatewayd.yaml The file will be available even after reinstalling the service, so the token will be picked up from there. However, if the token was created under /var/lib/sft-gatewayd, then it needs to be added again before running step 3.
