{"record":{"id":"97ef654110572481","repo":"nats-io/nats-server","slug":"unable-to-get-auth-session-v","errorCode":null,"errorMessage":"unable to get auth session: %v","messagePattern":"unable to get auth session: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/tpm/js_ek_tpm_windows.go","lineNumber":189,"sourceCode":"\t\treturn \"\", fmt.Errorf(\"unable to write key file: %v\", err)\n\t}\n\treturn string(jsStoreKey), nil\n}\n\n// Unseals the JetStream encryption key from the TPM with the provided keys.\n// The key is returned as a string.\nfunc unsealJsEncrpytionKey(rwc io.ReadWriteCloser, pcr int, srkHandle tpmutil.Handle, srkPassword, objectPassword string, publicBlob, privateBlob []byte) (string, error) {\n\t// Load the public/private blobs into the TPM for decryption.\n\tobjectHandle, _, err := tpm2.Load(rwc, srkHandle, srkPassword, publicBlob, privateBlob)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"unable to load data: %v\", err)\n\t}\n\tdefer tpm2.FlushContext(rwc, objectHandle)\n\n\t// Create the authorization session with TPM.\n\tsessHandle, _, err := policyPCRPasswordSession(rwc, pcr)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"unable to get auth session: %v\", err)\n\t}\n\tdefer func() {\n\t\ttpm2.FlushContext(rwc, sessHandle)\n\t}()\n\t// Unseal the data we've loaded into the TPM with the object (js key) password.\n\tunsealedData, err := tpm2.UnsealWithSession(rwc, sessHandle, objectHandle, objectPassword)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"unable to unseal data: %v\", err)\n\t}\n\treturn string(unsealedData), nil\n}\n\n// Returns session handle and policy digest.\nfunc policyPCRPasswordSession(rwc io.ReadWriteCloser, pcr int) (sessHandle tpmutil.Handle, policy []byte, retErr error) {\n\tsessHandle, _, err := tpm2.StartAuthSession(\n\t\trwc,\n\t\ttpm2.HandleNull,  /*tpmKey*/\n\t\ttpm2.HandleNull,  /*bindKey*/","sourceCodeStart":171,"sourceCodeEnd":207,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/tpm/js_ek_tpm_windows.go#L171-L207","documentation":"unsealJsEncrpytionKey could not create the policy PCR+password authorization session via policyPCRPasswordSession. The wrapped error from StartAuthSession (or later policy commands) is embedded in %v.","triggerScenarios":"policyPCRPasswordSession(rwc, pcr) returns error — TPM auth session limit reached, invalid PCR index, or TPM communication failure.","commonSituations":"Invalid pcr value configured (out of range for the PCR bank); TPM session table full from leaked sessions; TPM device in a failed/locked state.","solutions":["Check the embedded %v cause from StartAuthSession.","Validate the configured pcr index is a valid SHA-256 PCR (0-23 on typical TPMs).","Restart the process/host to clear leaked sessions if the session table is full.","Confirm the TPM device is healthy (run tpm2_getcap or vendor diagnostics)."],"exampleFix":"// before: unchecked PCR value\nkey, err := unsealJsEncrpytionKey(rwc, pcr, srkHandle, ...)\n// after: validate pcr config first\nif pcr < 0 || pcr > 23 {\n\treturn \"\", fmt.Errorf(\"invalid PCR index %d\", pcr)\n}\nkey, err := unsealJsEncrpytionKey(rwc, pcr, srkHandle, ...)","handlingStrategy":"retry","validationCode":"if pcr < 0 || pcr > 23 {\n\treturn fmt.Errorf(\"invalid PCR index %d\", pcr)\n}\nif _, err := tpm2.ReadPCRs(rwc, tpm2.PCRSelection{Hash: tpm2.AlgSHA256, PCRs: []int{pcr}}); err != nil {\n\treturn fmt.Errorf(\"PCR %d not readable: %w\", pcr, err)\n}","typeGuard":null,"tryCatchPattern":"var key string\nvar err error\nfor i := 0; i < 3; i++ {\n\tkey, err = LoadJetStreamEncryptionKeyFromTPM(rwc)\n\tif err == nil || !strings.Contains(err.Error(), \"unable to get auth session\") {\n\t\tbreak\n\t}\n\ttime.Sleep(200 * time.Millisecond)\n}","preventionTips":["Validate the configured PCR index against the TPM's PCR capabilities.","Limit concurrent TPM users to avoid session table exhaustion.","Always FlushContext for every started session.","Monitor TPM health at startup."],"tags":["tpm","windows","auth-session","pcr","go"],"backgroundTag":"tpm-session-start-failed","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}