OpenNHP/opennhp · error

registration failed

Error message

registration failed: %s

What it means

After sending a registration knock, runRegisterApp inspects the server's response; when the server reports an error message, the command surfaces it as `registration failed: <server message>` so that deferred cleanup (a.Stop()) still runs and main() can exit non-zero. The embedded text is the rejection reason sent by the NHP server.

Solutions

1. Read the embedded server message after the colon — it states the server-side rejection reason.
2. Register/approve the agent's public key with the server (registration list or plugin ACL).
3. Verify the asp-id/res-id exist on the server's resource/auth configuration.
4. If keys were rotated, redeploy peer tables so server and agent share current keys, then retry.

Example fix

// server side: approve the agent identity before retrying
// agent side: verify identity then re-run
nhp-agent register --server nhp-server-cluster   # read exact server reason from error text

if resp.ErrMsg != "" {
    return fmt.Errorf("registration failed: %s", resp.ErrMsg)
}

if err := runRegisterApp(a, args); err != nil {
    fmt.Fprintf(os.Stderr, "register: %v\n", err) // deferred a.Stop() still runs
    return err
}

When it happens

Trigger: Server registration response arrives with a non-empty errMsgStr (e.g. agent not approved, duplicate/unknown identity, policy rejection) during runRegisterApp.

Common situations: Agent public key not yet trusted by the server's plugin/ACL; asp-id not registered with the auth service provider; server-side policy rejecting the resource request; expired or rotated server keys after generate-nhp-keys.sh --regenerate.

Related errors

• registration failed
• AuthServiceId is required
• no server cluster: set Cluster in resource.toml or use…
• failed to create device from new key
• keystore: query pubkey conflict

AI-assisted analysis of OpenNHP/opennhp@6e04ca5ff0 (2026-09-07). Data as JSON: /api/errors/9a8028256d8ab5e6. Report an issue: GitHub.

Appendix: source

Thrown at endpoints/agent/main/main.go:652

		errMsgStr := regErr.Error()
		if rakMsg != nil {
			errCode = rakMsg.ErrCode
			if rakMsg.ErrMsg != "" {
				errMsgStr = rakMsg.ErrMsg
			}
		}
		fmt.Println()
		fmt.Printf("  %s❌ Registration failed%s\n", colorYellow, colorReset)
		if errCode != "" {
			fmt.Printf("  %sError code:%s  %s\n", colorYellow, colorReset, errCode)
		}
		fmt.Printf("  %sError:%s        %s\n", colorYellow, colorReset, errMsgStr)
		fmt.Println()
		// Return the error instead of os.Exit so the deferred a.Stop()
		// (and any other cleanup) still runs. main() maps a non-nil error
		// to a non-zero exit code.
		if errMsgStr != "" {
			return fmt.Errorf("registration failed: %s", errMsgStr)
		}
		return fmt.Errorf("registration failed")
	}

	// Registration succeeded — print results.
	pubKey := a.PublicKeyBase64ByCipherScheme()
	privKey := a.PrivateKeyBase64()
	fmt.Println()
	fmt.Printf("  %s✅ Registration successful!%s\n", colorGreen, colorReset)
	fmt.Println()
	fmt.Printf("  %sEmail (UserId):%s   %s\n", colorYellow, colorReset, email)
	fmt.Printf("  %sAuthServiceId:%s    %s\n", colorYellow, colorReset, aspId)
	if orgId != "" {
		fmt.Printf("  %sOrganization:%s     %s\n", colorYellow, colorReset, orgId)
	}
	if deviceId != "" {
		fmt.Printf("  %sDevice ID:%s        %s\n", colorYellow, colorReset, deviceId)
	}

View on GitHub (pinned to 6e04ca5ff0)