agent.sock not found

[ThisGuyNeedsABeer]

Describe the bug

The required agent.sock from /root/.local/share/authentik is missing following the deployment steps from:

• https://docs.goauthentik.io/endpoint-devices/authentik-agent/
• https://docs.goauthentik.io/endpoint-devices/authentik-agent/agent-deployment/linux/

sudo apt install libnss-authentik libpam-authentik authentik-cli authentik-agent authentik-sysd

How to reproduce

1. Follow steps: https://docs.goauthentik.io/endpoint-devices/authentik-agent/agent-deployment/linux/
2. Attempt to complete the enrollment via: ak config setup --authentik-url "https://auth.mydomain.com/"
3. Navigate to URL shown: https://auth.mydomain.com/device?code=XXXXXXXXX"
4. Receive confirmation you can close the window (authentication successful)
5. Error received (shown below in log output)
6. Confirmed file is not present anywhere on system via find / -name agent.sock

Expected behavior

Enrollment to complete via call to agent.sock

Screenshots

Additional context

Test host details
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 24.04.3 LTS
Release: 24.04
Codename: noble

Device did register in the Authentik portal.

Deployment Method

Docker

Version

2025.12.2

Relevant log output

WARN[0012] finished call                                 grpc.code=Unavailable grpc.component=client grpc.error="rpc error: code = Unavailable desc = connection error: desc = \"transport: Error while dialing: dial unix /root/.local/share/authentik/agent.sock: connect: no such file or directory\"" grpc.method=Setup grpc.method_type=unary grpc.service=agent_ctrl.AgentCtrl grpc.start_time="2026-01-31T17:03:40Z" grpc.time_ms=3.951 logger=cli.grpc protocol=grpc
Error: rpc error: code = Unavailable desc = connection error: desc = "transport: Error while dialing: dial unix **/root/.local/share/authentik/agent.sock: connect: no such file or directory**"

[patschi]

I was just about to grab my output and file the same issue. I'm experiencing same issues with 2025.12.2 (not tested any earlier release). Using Ubuntu 22.04.

All dependencies as per docs are installed:

root@ubuntu:~# apt install authentik-cli authentik-agent authentik-sysd
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
authentik-agent is already the newest version (0.35.9).
authentik-cli is already the newest version (0.35.9).
authentik-sysd is already the newest version (0.35.9).
0 upgraded, 0 newly installed, 0 to remove and 2 not upgraded.

Joining authentik works (device is shown and updating accordingly):

root@ubuntu:~# ak-sysd domains join AK-MAIN --authentik-url https://authentik.company
Enter authentik enrollment token:

But completing config setup fails:

root@ubuntu:~# ak config setup --authentik-url https://authentik.company -v

     Open this URL in your browser: https://authentik.company/device?code=xxxxxxxxxxxxx

DEBU[0020] started call                                  grpc.component=client grpc.method=Setup grpc.method_type=unary grpc.service=agent_ctrl.AgentCtrl grpc.start_time="2026-01-31T20:57:35                                                                          Z" grpc.time_ms=0.044 logger=cli.grpc protocol=grpc
WARN[0020] finished call                                 grpc.code=Unavailable grpc.component=client grpc.error="rpc error: code = Unavailable desc = connection error: desc = \"transport: Er                                                                          ror while dialing: dial unix /root/.local/share/authentik/agent.sock: connect: no such file or directory\"" grpc.method=Setup grpc.method_type=unary grpc.service=agent_ctrl.AgentCtrl grpc.st                                                                          art_time="2026-01-31T20:57:35Z" grpc.time_ms=1.644 logger=cli.grpc protocol=grpc
Error: rpc error: code = Unavailable desc = connection error: desc = "transport: Error while dialing: dial unix /root/.local/share/authentik/agent.sock: connect: no such file or directory"

I can't find any systemd service related to an agent however:

root@ubuntu:~# systemctl list-units --no-pager | grep -i ak
  ak-sysd.service                                                    loaded    active running   authentik sysd
root@ubuntu:~# systemctl list-units --no-pager | grep -i agent
root@ubuntu:~#

Using --socket /var/run/authentik/sys.sock or --socket /var/run/authentik/sys-ctrl.sock also fails.

But I can't find any socket at /root/.local/share/authentik/agent.sock nor when using find. Also, the docs at https://docs.goauthentik.io/endpoint-devices/authentik-agent/#technical-information doesn't list any agent.sock?

[patschi]

When starting ak-sysd via agent mode in debug mode, it only starts sockets on below paths:

root@ubuntu:/etc/authentik# /usr/bin/ak-sysd agent -d
INFO[0000] Opening db file (/var/lib/authentik/sysd-state.db) with mode -rw------- and with options: {Timeout: 1s, NoGrowSync: false, NoFreelistSync: false, PreLoadFreelist: false, FreelistType: , ReadOnly: false, MmapFlags: 0, InitialMmapSize: 0, PageSize: 0, NoSync: false, OpenFile: 0x0, Mlock: false, Logger: 0xc0001d04d0}  logger=storage.state
[...]
INFO[0000] System agent listening on socket              logger=sysd path=/var/run/authentik/sys-ctrl.sock pid=3114650 srv=ctrl target=ak-sysd
INFO[0000] System agent listening on socket              logger=sysd path=/var/run/authentik/sys.sock pid=3114650 srv=default target=ak-sysd

When specifying it directly, it also brings no success: (after successful authentication)

root@ubuntu:/etc/authentik# ak config setup --socket /var/run/authentik/sys.sock --authentik-url https://authentik.company --verbose

     Open this URL in your browser: https://authentik.company/device?code=xxxxxxxxxxx

DEBU[0011] started call                                  grpc.component=client grpc.method=Setup grpc.method_type=unary grpc.service=agent_ctrl.AgentCtrl grpc.start_time="2026-01-31T22:17:09Z" grpc.time_ms=0.069 logger=cli.grpc protocol=grpc
WARN[0011] finished call                                 grpc.code=Unimplemented grpc.component=client grpc.error="rpc error: code = Unimplemented desc = unknown service agent_ctrl.AgentCtrl" grpc.method=Setup grpc.method_type=unary grpc.service=agent_ctrl.AgentCtrl grpc.start_time="2026-01-31T22:17:09Z" grpc.time_ms=4.491 logger=cli.grpc protocol=grpc
Error: rpc error: code = Unimplemented desc = unknown service agent_ctrl.AgentCtrl
Usage:
  ak config setup [flags]

Flags:
  -d, --app string             Slug of the CLI application (default "authentik-cli")
  -a, --authentik-url string   URL to the authentik Instance
  -i, --client-id string       Client ID (default "authentik-cli")
  -h, --help                   help for setup

Global Flags:
  -j, --json             Output JSON data
  -n, --profile string   A name for the profile (default "default")
  -s, --socket string    Socket the agent is listening on (default "/root/.local/share/authentik/agent.sock")
  -v, --verbose          Enable debug logging

[patschi]

Updated to 0.40.0, and still the same: (also tried purging authentik packages and perform join from scratch)

root@pkixl01:~# ak version
WARN[0000] finished call                                 grpc.code=Unavailable grpc.component=client grpc.error="rpc error: code = Unavailable desc = connection error: desc = \"transport: Error while dialing: dial unix /root/.local/share/authentik/agent.sock: connect: no such file or directory\"" grpc.method=Ping grpc.method_type=unary grpc.service=ping.Ping grpc.start_time="2026-02-02T17:27:10Z" grpc.time_ms=1.192 logger=cli.grpc protocol=grpc
authentik Agent CLI: 0.40.0-bab22e55
Agent: rpc error: code = Unavailable desc = connection error: desc = "transport: Error while dialing: dial unix /root/.local/share/authentik/agent.sock: connect: no such file or directory"
System: 0.40.0-bab22e55

[BeryJu]

@patschi @ThisGuyNeedsABeer are y'all testing this on an ubuntu desktop machine or ubuntu server/a headless machine? I think on a headless machine the system agent (sysd) does not start the user agent (ak-agent), where as on a desktop machine it does

The user agent (ak-agent) is installed as a systemctl user service, so you should be able to run systemctl start --user ak-agent

[patschi]

Correct. Headless/server it is. (I picked old Ubuntu 22.04 as it was installed on a test system already)

Using your approach worked indeed:

root@pkidexl01:~# systemctl start --user ak-agent
root@pkidexl01:~# systemctl status --user ak-agent
● ak-agent.service - authentik Agent
     Loaded: loaded (/etc/xdg/systemd/user/ak-agent.service; disabled; vendor preset: enabled)
     Active: active (running) since Mon 2026-02-02 22:54:07 UTC; 4s ago
   Main PID: 2950 (ak-agent)
      Tasks: 8 (limit: 978)
     Memory: 29.7M
        CPU: 63ms
     CGroup: /user.slice/user-0.slice/user@0.service/app.slice/ak-agent.service
             └─2950 /usr/bin/ak-agent

Feb 02 22:54:07 pkidexl01 ak-agent[2950]: level=debug msg="loading config" logger=storage.config pid=2950 target=ak-agent
Feb 02 22:54:07 pkidexl01 ak-agent[2950]: level=debug msg="no config found, defaulting to empty" error="open /root/.config/authentik/config.json: no such file or directory" logger=storage.config pid=2950 target=ak-agent
Feb 02 22:54:07 pkidexl01 ak-agent[2950]: level=debug msg="Starting config watch" logger=storage.config pid=2950 target=ak-agent
Feb 02 22:54:07 pkidexl01 ak-agent[2950]: level=info msg="Acquiring lock..." logger=agent path=/root/.config/authentik/agent.lock pid=2950 target=ak-agent
Feb 02 22:54:07 pkidexl01 ak-agent[2950]: level=debug msg="starting systray" logger=agent.tray pid=2950 target=ak-agent
Feb 02 22:54:07 pkidexl01 ak-agent[2950]: level=info msg="Starting GRPC server" logger=agent pid=2950 socket=/root/.local/share/authentik/agent.sock target=ak-agent
Feb 02 22:54:07 pkidexl01 ak-agent[2950]: level=debug msg="Updating systray items" logger=agent.tray pid=2950 target=ak-agent
Feb 02 22:54:07 pkidexl01 ak-agent[2950]: level=debug msg="started call" grpc.component=client grpc.method=Ping grpc.method_type=unary grpc.service=ping.Ping grpc.start_time="2026-02-02T22:54:07Z" grpc.time_ms=0.006 logger=cli.system_grpc protocol=grpc
Feb 02 22:54:07 pkidexl01 ak-agent[2950]: level=debug msg="finished call" grpc.code=OK grpc.component=client grpc.method=Ping grpc.method_type=unary grpc.service=ping.Ping grpc.start_time="2026-02-02T22:54:07Z" grpc.time_ms=48.334 logger=cli.system_grpc protocol=>
Feb 02 22:54:07 pkidexl01 ak-agent[2950]: 2026/02/02 22:54:07 systray error: failed to register our icon with the notifier watcher (maybe no tray is running?): The name org.kde.StatusNotifierWatcher was not provided by any .service files


root@pkidexl01:~# ak config setup --authentik-url https://authentik.company

     Open this URL in your browser: https://authentik.company/device?code=663440820

root@pkidexl01:~#

Is integration of headless-server-systems not intended? (Feels useful in combination with SSH login)

[ThisGuyNeedsABeer]

@patschi @ThisGuyNeedsABeer are y'all testing this on an ubuntu desktop machine or ubuntu server/a headless machine? I think on a headless machine the system agent (sysd) does not start the user agent (ak-agent), where as on a desktop machine it does

The user agent (ak-agent) is installed as a systemctl user service, so you should be able to run systemctl start --user ak-agent

Fresh install Ubuntu server, also headless. Using the above steps worked as well.

root@authentik-test:/# systemctl start --user ak-agent
root@authentik-test:/# systemctl status --user ak-agent
● ak-agent.service - authentik Agent
     Loaded: loaded (/etc/xdg/systemd/user/ak-agent.service; disabled; preset: enabled)
     Active: active (running) since Mon 2026-02-02 23:31:25 UTC; 7s ago
   Main PID: 11136 (ak-agent)
      Tasks: 9 (limit: 2307)
     Memory: 30.6M (peak: 30.8M)
        CPU: 110ms
     CGroup: /user.slice/user-0.slice/user@0.service/app.slice/ak-agent.service
             └─11136 /usr/bin/ak-agent

Feb 02 23:31:25 authentik-test ak-agent[11136]: level=debug msg="loading config" logger=storage.config pid=11136 target=ak-agent
Feb 02 23:31:25 authentik-test ak-agent[11136]: level=debug msg="no config found, defaulting to empty" error="open /root/.config/authentik/config.json: no such >
Feb 02 23:31:25 authentik-test ak-agent[11136]: level=debug msg="Starting config watch" logger=storage.config pid=11136 target=ak-agent
Feb 02 23:31:25 authentik-test ak-agent[11136]: level=info msg="Acquiring lock..." logger=agent path=/root/.config/authentik/agent.lock pid=11136 target=ak-agent
Feb 02 23:31:25 authentik-test ak-agent[11136]: level=debug msg="starting systray" logger=agent.tray pid=11136 target=ak-agent
Feb 02 23:31:25 authentik-test ak-agent[11136]: level=info msg="Starting GRPC server" logger=agent pid=11136 socket=/root/.local/share/authentik/agent.sock targ>
Feb 02 23:31:25 authentik-test ak-agent[11136]: level=debug msg="Updating systray items" logger=agent.tray pid=11136 target=ak-agent
Feb 02 23:31:25 authentik-test ak-agent[11136]: level=debug msg="started call" grpc.component=client grpc.method=Ping grpc.method_type=unary grpc.service=ping.P>
Feb 02 23:31:25 authentik-test ak-agent[11136]: level=debug msg="finished call" grpc.code=OK grpc.component=client grpc.method=Ping grpc.method_type=unary grpc.>
Feb 02 23:31:25 authentik-test ak-agent[11136]: 2026/02/02 23:31:25 systray error: failed to register our icon with the notifier watcher (maybe no tray is runni>

root@authentik-test:/# ak config setup --authentik-url https://authentik.company

     Open this URL in your browser: https://authentik.company/device?code=XXXXXXXXX

root@authentik-test:/#

[BeryJu]

the idea with headless machine is that you'd run the agent on your local machine and then use ak ssh, which will forward your local agent to the remote system.

Also to clear up one other thing, if you just want ak ssh and other such things with the CLI, you don't need the system agent, however you will need it on a remote system that you ak ssh to.

[ThisGuyNeedsABeer]

So I just ran the install on second headless Ubuntu 24.0.4 server and am now getting a new error. This was after updating to 2025.12.3 earlier.

Had to run as non-root. D'oh! Lower issue remains

root@docker02:~# sudo ak-sysd domains join "<domain>" --authentik-url https://authentik.company
Enter authentik enrollment token: <entered-token>
root@docker02:~# systemctl start --user ak-agent
Failed to connect to bus: No medium found

root@docker02:~# apt install libnss-authentik libpam-authentik authentik-cli authentik-agent authentik-sysd
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
libnss-authentik is already the newest version (0.40.0).
libpam-authentik is already the newest version (0.40.0).
authentik-cli is already the newest version (0.40.0).
authentik-agent is already the newest version (0.40.0).
authentik-sysd is already the newest version (0.40.0).
0 upgraded, 0 newly installed, 0 to remove and 23 not upgraded.

Also to clear up one other thing, if you just want ak ssh and other such things with the CLI, you don't need the system agent, however you will need it on a remote system that you ak ssh to.

I installed the Windows package and then got this error trying to connect to a machine that has the agent running.

PS C:\Users\Test> ak config setup --authentik-url "https://authentik.company/"
PS C:\Users\Test> ak whoami
User Information:
├── email: [redacted]
├── email_verified: false
├── given_name: [redacted]
├── groups
│   ├── [0]: [redacted]
│   ├── [1]: [redacted]
│   ├── [2]: [redacted]
│   ├── [3]: [redacted]
│   ├── [4]: [redacted]
│   ╰── [5]: [redacted]
├── name: test-user
├── nickname: test-user
├── preferred_username: test-user
╰── sub: d9054eb775dc3fe5fd3f5ee131393b539267637a0114cc71a1de6fb7c08416c8
PS C:\Users\Test> ak ssh 172.16.16.253
Error: failed to read known_hosts: knownhosts: C:\Users\Testn/.ssh/known_hosts:52: illegal base64 data at input byte 70