Skip to main content

Troubleshooting

If something isn't working, start here.

ck-prism: command not found​

The package installed, but the scripts directory isn't on your PATH. See Installation → Make Sure ck-prism Is on Your PATH for the exact path on your operating system and how to add it.

A quick check:

python3 -m pip show ck-prism

If this prints a version, the package is installed; the problem is PATH only.

The Browser Doesn't Open Automatically​

ck-prism prints a message like:

Opening browser for authentication...

If browser did not open, visit:
https://login.prism.cloudkeeper.com/realms/...

Copy the URL from the terminal and paste it into your browser. Finish the login there; ck-prism will detect the callback and continue.

Common reasons the auto-open fails:

  • Running over SSH without display forwarding
  • A minimal Linux install without xdg-open
  • WSL without a configured browser handler

On Linux you can test your default URL launcher with:

xdg-open https://example.com

If that prints an error, fix your xdg-open / xdg-utils installation or just use the copy-paste fallback.

Authentication timed out​

The login window is open for about three minutes. If you take longer than that (or if the SSO provider throws an error mid-login), ck-prism gives up. Re-run the command and finish the browser step more quickly.

If this keeps happening, check your network and VPN: the browser must be able to reach login.<your-prism-domain> and your machine must be reachable on http://127.0.0.1:<random-port> for the callback.

Profile '<name>' not found​

The profile you passed to --profile doesn't exist in ~/.ck-prism/config.json. Run:

ck-prism profiles list

to see what's configured, then either use one of those names or run ck-prism configure to create a new profile.

AWS CLI Says Credentials Are Expired​

Temporary credentials issued by ck-prism last about 12 hours. Once they expire, re-run:

ck-prism login --profile <name>

If your SSO token is still valid (hours to days, depending on your Prism session policy), this won't open a browser; it just fetches fresh AWS credentials.

credential_process Is Ignored​

The AWS CLI prefers static credentials in ~/.aws/credentials over credential_process entries in ~/.aws/config. If you have both for the same profile, static wins.

Run ck-prism profiles enable-credential-process <name> (or ck-prism profiles migrate-credential-process for every profile at once). This rewrites ~/.aws/config with the correct entry and removes the shadowing static credentials from ~/.aws/credentials. If you prefer to do it by hand, remove the [<profile>] section from ~/.aws/credentials yourself.

Tab-Completion Installed for the Wrong Shell​

ck-prism setup-completions detects the shell from your current terminal. If it guesses wrong (most commonly when you launched another shell manually inside an existing session, so the login shell and the running shell differ), pass --shell explicitly:

ck-prism setup-completions --shell zsh
ck-prism setup-completions --shell bash

Then restart your terminal (or source the path it prints) so completions activate.

Configuration File Is Invalid or Empty​

If ~/.ck-prism/config.json got corrupted (manual edit, disk full during write, etc.) ck-prism refuses to run and prints:

Configuration file is invalid or empty. Run ck-prism configure

Open the file and verify it's valid JSON. If you can't recover it, delete or rename it and re-run ck-prism configure to regenerate it.

Getting Help​

If none of the above applies, contact your CloudKeeper representative with:

  • The exact command you ran.
  • The full output ck-prism printed.
  • The contents of ~/.ck-prism/config.json (redact role ARNs if needed).
  • Your ck-prism --version output (or pip3 show ck-prism).