{"record":{"id":"5e721e310f622492","repo":"nats-io/nats-server","slug":"unable-to-require-password-for-auth-policy-v","errorCode":null,"errorMessage":"unable to require password for auth policy: %v","messagePattern":"unable to require password for auth policy: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/tpm/js_ek_tpm_windows.go","lineNumber":232,"sourceCode":"pcrSelection := tpm2.PCRSelection{\n\tHash: tpm2.AlgSHA256,\n\tPCRs: []int{pcr},\n}\nif err := tpm2.PolicyPCR(rwc, sessHandle, nil, pcrSelection); err != nil {\n\treturn sessHandle, nil, fmt.Errorf(\"unable to bind PCRs to auth policy: %v\", err)\n}\nif err := tpm2.PolicyPassword(rwc, sessHandle); err != nil {\n\treturn sessHandle, nil, fmt.Errorf(\"unable to require password for auth policy: %v\", err)\n}\npolicy, err = tpm2.PolicyGetDigest(rwc, sessHandle)\nif err != nil {\n\treturn sessHandle, nil, fmt.Errorf(\"unable to get policy digest: %v\", err)\n}\nreturn sessHandle, policy, nil","sourceCodeStart":214,"sourceCodeEnd":250,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/tpm/js_ek_tpm_windows.go#L214-L250","documentation":"tpm2.PolicyPassword failed while asserting the PolicyPassword (PW) command on the policy session, which requires a password on subsequent authorization. The TPM rejected the command — typically an invalid session handle or TPM parameter error — so the policy cannot require password auth and sealing/unsealing is aborted.","triggerScenarios":"tpm2.PolicyPassword(rwc, sessHandle) returns error — invalid session handle (already flushed/terminated) or TPM communication failure.","commonSituations":"Session died between PolicyPCR and PolicyPassword (connection drop); TPM in lockout; rare TPM firmware quirks.","solutions":["Check the wrapped TPM error code for the exact TPM_RC failure","Verify the session handle is still valid (not flushed or expired)","Retry the policy session creation after the TPM recovers","Confirm TPM firmware supports the PolicyPassword command"],"exampleFix":"// before: partial retry of single policy step\n// after: retry whole session creation\nvar sessHandle tpmutil.Handle\nvar policy []byte\nfor i := 0; i < 3; i++ {\n\tsessHandle, policy, err = policyPCRPasswordSession(rwc, pcr)\n\tif err == nil {\n\t\tbreak\n\t}\n}","handlingStrategy":"retry","validationCode":null,"typeGuard":"func isPolicyPasswordError(err error) bool {\n\treturn err != nil && strings.Contains(err.Error(), \"unable to require password for auth policy\")\n}","tryCatchPattern":"sessHandle, policy, err := policyPCRPasswordSession(rwc, pcr)\nif err != nil && isPolicyPasswordError(err) {\n\t// policy commands are atomic as a group; retry the whole session\n\tsessHandle, policy, err = policyPCRPasswordSession(rwc, pcr)\n}","preventionTips":["Retry the entire session creation, never individual policy steps.","Avoid concurrent TPM operations that could invalidate the session.","Check TPM lockout state after repeated auth failures."],"tags":["tpm","windows","policy","password","go"],"backgroundTag":"tpm-policy-command-failed","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}