HRESULT 0x80280124 (TPM_20_E_AUTH_TYPE): meaning and diagnosis

Status / error code:

Category:

Constant name:

Source:

Facility:

Operating System:

Description:

the authorization session type is not valid for the requested TPM command role.

Previous	Next
TPM_20_E_EXCLUSIVE	TPM_20_E_AUTH_MISSING

TPM_20_E_AUTH_TYPE

The TPM accepted the command structure far enough to evaluate authorization roles, then found that the supplied session type was wrong for that role. A correct handle and correct secret do not fix this class of error when the command requires a policy session rather than a password or ordinary HMAC session.

Roles that commonly matter

DUP-role authorization requires a policy session.
ADMIN-role authorization requires a policy session for an object whose adminWithPolicy attribute is set, and for an NV index.
USER-role authorization requires a policy session when an object has userWithAuth clear.

Useful checks

Inspect the command's documented authorization role and the target object's public attributes or NV attributes. Then inspect the session handle sent in the authorization area: trial sessions cannot authorize operations, and an HMAC session is not interchangeable with a policy session. Rebuild the request with a policy session that contains the required policy commands instead of replacing credentials blindly.

TCG: authorization roles and session types · tpm2_startauthsession · TPM 2.0 Library

Looking for a different code? Search another status or error code.