Skip to main content

Troubleshooting

If something isn't working, start here.

ck-prism: command not found​

The package installed, but the scripts directory isn't on your PATH. See Installation → Make Sure ck-prism Is on Your PATH for the exact path on your operating system and how to add it.

A quick check:

python3 -m pip show ck-prism

If this prints a version, the package is installed — the problem is PATH only.

The Browser Doesn't Open Automatically​

ck-prism prints a message like:

Opening browser for authentication...

If browser did not open, visit:
https://login.prism.cloudkeeper.com/realms/...

Copy the URL from the terminal and paste it into your browser. Finish the login there; ck-prism will detect the callback and continue.

Common reasons the auto-open fails:

  • Running over SSH without display forwarding
  • A minimal Linux install without xdg-open
  • WSL without a configured browser handler

On Linux you can test your default URL launcher with:

xdg-open https://example.com

If that prints an error, fix your xdg-open / xdg-utils installation or just use the copy-paste fallback.

Authentication timed out​

The login window is open for about three minutes. If you take longer than that — or if the SSO provider throws an error mid-login — ck-prism gives up. Re-run the command and finish the browser step more quickly.

If this keeps happening, check your network and VPN: the browser must be able to reach login.<your-prism-domain> and your machine must be reachable on http://127.0.0.1:<random-port> for the callback.

Profile '<name>' not found​

The profile you passed to --profile doesn't exist in ~/.ck-prism/config.json. Run:

ck-prism profiles list

to see what's configured, then either use one of those names or run ck-prism configure to create a new profile.

AWS CLI Says Credentials Are Expired​

Temporary credentials issued by ck-prism last about 12 hours. Once they expire, re-run:

ck-prism login --profile <name>

If your SSO token is still valid (hours to days, depending on your Prism session policy), this won't open a browser — it just fetches fresh AWS credentials.

credential_process Is Ignored​

The AWS CLI prefers static credentials in ~/.aws/credentials over credential_process entries in ~/.aws/config. If you have both for the same profile, static wins.

Run ck-prism profiles enable-credential-process <name> (or ck-prism profiles migrate-credential-process for every profile at once) — this rewrites ~/.aws/config with the correct entry and removes the shadowing static credentials from ~/.aws/credentials. If you prefer to do it by hand, remove the [<profile>] section from ~/.aws/credentials yourself.

Tab-Completion Installed for the Wrong Shell​

ck-prism setup-completions detects the shell from your current terminal. If it guesses wrong — most commonly when you launched another shell manually inside an existing session, so the login shell and the running shell differ — pass --shell explicitly:

ck-prism setup-completions --shell zsh
ck-prism setup-completions --shell bash

Then restart your terminal (or source the path it prints) so completions activate.

Configuration File Is Invalid or Empty​

If ~/.ck-prism/config.json got corrupted (manual edit, disk full during write, etc.) ck-prism refuses to run and prints:

Configuration file is invalid or empty. Run ck-prism configure

Open the file and verify it's valid JSON. If you can't recover it, delete or rename it and re-run ck-prism configure to regenerate it.

Getting Help​

If none of the above applies, contact your CloudKeeper representative with:

  • The exact command you ran.
  • The full output ck-prism printed.
  • The contents of ~/.ck-prism/config.json (redact role ARNs if needed).
  • Your ck-prism --version output (or pip3 show ck-prism).