Troubleshooting

Common issues and troubleshooting for your Automator service

Unable to communicate with the Automator service

There are several reasons why Keeper Commander is unable to communicate with your Automator service:

• Ensure the Automator service is open to Keeper IP addresses. See Ingress requirements. Add your IP address to troubleshoot the connection.
• If you use a custom SSL certificate, ensure Automator loads it. Check the Automator logs after restarting the service. If your IP address is allowed, run this health check:

  curl https://automator.mycompany.com/health

• Check that the certificate subject name matches the FQDN.
• Ensure the SSL certificate includes the CA intermediate chain. This is the most common issue. Keeper refuses connections when the intermediate chain is missing. Use openssl to check the chain:

openssl s_client -showcerts -servername automator.company.com -connect automator.company.com

This command shows the certificates in the chain. One certificate means the full chain is not loaded. See Step 4 in Custom SSL Certificate.

400 Error in Health Checks

This may occur when the health check request URI differs from the SSL certificate domain. Disable SNI checks to allow the health check to complete.

Set disable_sni_check=true in the Automator configuration. Alternatively, set the DISABLE_SNI_CHECK environment variable to true.

Automator Service not Approving Requests

Check the Automator logs to identify the potential cause of a service disruption.

Re-run setup and initialization

Run the setup and initialization sequence:

My Vault> automator list
ID — Name — Node ID — Enabled — URL — Skills
123626338648827 — Production Keeper Automator — 123626338648102 — True — https://acaprodautomator.westus.azurecontainerapps.io — Device Approval, Team Approval, Team For User Approval

My Vault> automator setup 123626338648827
Automator "Production Keeper Automator" is setup

My Vault> automator init 123626338648827
Automator ID: 123626338648827
Name: Production Keeper Automator
Node ID: 123626338648102
URL: https://acaprodautomator.westus.azurecontainerapps.io
Version: 17.1.2.12
Enabled: Yes
Skills: Device Approval : Team Approval : Team For User Approval

Automator Settings

idp_public_certificate: idp_public_certificate=xxx
idp_entity_id: idp_entity_id=http://xxx
idp_metadata_xml: idp_metadata_xml=.xxx
sso_entity_ID: sso_entity_ID=https://keepersecurity.eu/api/rest/sso/saml/xxx
saml_email_mapping: saml_email_mapping=Email
email_domains: email_domains=
filter_by_email_domains: filter_by_email_domains=false
ssl_mode: ssl_mode=certificate
disable_sni_check: disable_sni_check=false
ssl_certificate_filename: ssl_certificate_filename=
ssl_certificate_file_password: ssl_certificate_file_password=
ssl_certificate_key_password: ssl_certificate_key_password=
automator_host: automator_host=acaprodautomator.westus.azurecontainerapps.io
automator_port: automator_port=443
ip_allow: ip_allow=
ip_deny: ip_deny=

Resolve NEEDS_CRYPTO

Automator in NEEDS_CRYPTO lacks enterprise private keys. These keys decrypt incoming SAML assertions.

Root cause

During setup_crypto, KeeperApp encrypts enterprise EC and RSA private keys. It uses Automator’s public key. Automator decrypts and stores them in config/config-{automatorId}.data. The stored data uses the master key for encryption.

Without this material, Automator cannot decrypt SAML assertions.

Common triggers

• setup_crypto was not completed after a fresh deployment.
• The /config/ directory was lost or uses ephemeral storage.
• config/master_encryption.key is missing or changed.
• AUTOMATOR_CONFIG_KEY changed between restarts.
• full_reset removed the configuration.

Diagnose the issue

Check the status endpoint:

GET https://<automator-host>/api/rest/status/{automatorId}

NEEDS_CRYPTO or NEEDS_INIT means crypto was not loaded or was removed. Verify the configuration files:

ls -la /config/config-{automatorId}.data
ls -la /config/master_encryption.key

Fix the issue

Re-run setup_crypto with Keeper Commander:

keeper automator setup --id <automatorId>

Alternatively, use Admin Console → SSO → Automator → Edit → Setup Crypto.

This repeats the two-step EC keypair exchange. Automator then persists the enterprise keys.

If setup_crypto continues to fail, verify:

1. The master key is persistent and not regenerated at startup.
2. keeper.properties does not set persist_state=false.
3. /config/ uses persistent storage.

Resolve “setup step #1 error: No response from Automator”

Check the logs for setup_cryoto is rejected..server is RUNNING. Automator rejects setup requests while it is running. Perform a full reset, then repeat setup.

My Vault> automator reset <automator_ID>
My Vault> automator edit --skill=device --skill=team --skill=team_for_user <automator_ID>
My Vault> automator setup <automator_ID>
My Vault> automator init <automator_ID>
My Vault> automator enable <automator_ID>