IGA Xpress Service Startup Failure (Failed to connect to bus)

Products

• CA Identity Suite

Issue/Introduction

During or after the installation of IGA Xpress (IGX), the installer or the 'igactl' utility reports that services (like 'xpress') fail to start. Manual attempts to manage the service via 'systemctl --user' return the following error:

'Failed to connect to bus: No such file or directory' or 'Connection refused'.

Environment

IGA Xpress 1.0
IGA Suite v15

Cause

IGA Xpress uses 'systemd --user' to manage services under the application user (e.g., 'igx') with the principle of least privilege.

This failure typically occurs because:
1.  Impersonation via 'su' or 'pbrun': Using tools like 'pbrun su - root' to impersonate a user often fails to trigger the 'pam_systemd' module, which is responsible for creating the user's D-Bus session and setting the 'XDG_RUNTIME_DIR' environment variable.
2.  Missing Linger Status: By default, a user's 'systemd' instance only runs while they have an active login session. If the user never logs in directly, the session (and its bus) is never initialized.
3.  PAM Configuration: Hardened Linux environments (like RHEL) may have security policies that prevent 'pam_systemd.so' from creating user sessions for certain account types.

Resolution

1. Enable Linger for the Application User
To ensure the 'systemd' user instance starts at boot and persists without an active login session, enable 'lingering' for the 'igx' user:

loginctl enable-linger igx

To verify the state:

loginctl show-user igx | grep Linger
# Expected output: Linger=yes

2. Verify Environment Variables
Ensure that the 'XDG_RUNTIME_DIR' is correctly set. It should typically point to '/run/user/<UID>'.

export XDG_RUNTIME_DIR=/run/user/$(id -u igx)

3. Check PAM Configuration
Ensure that 'pam_systemd.so' is included in the relevant PAM session configurations (e.g., '/etc/pam.d/system-auth' or '/etc/pam.d/password-auth'). If using 'su' to switch to the user, verify '/etc/pam.d/su' includes:

session optional pam_systemd.so

4. Direct Login Requirement
If the environment uses complex PAM or security solutions (like certain PAM/PIM integrations) that prevent session creation via impersonation, the recommended approach is to log in directly as the 'igx' user via SSH to ensure the full user environment and D-Bus session are properly initialized.

Additional Information

Validation Tool
Use the following command to check the readiness of the system for 'systemctl --user' operations:

./check-systemd-usermode --user=igx