Skip to main content

← Overview

OmniAUSF Troubleshooting

Authentication fails with 404 USER_NOT_FOUND​

The UDM returned 404 for the subscriber during generate-auth-data. Confirm:

  1. udm_uri is correct and reachable from the OmniAUSF host.
  2. The subscriber (IMSI) is provisioned in the UDM/UDR/HSS backend.
  3. The SUCI presented by the AMF is well-formed and de-concealable by the UDM.

The AUSF logs AUSF auth failed for {supiOrSuci}: user not found at UDM.

Confirmation returns AUTHENTICATION_FAILURE (HTTP 200)​

The decoded resStar did not equal the stored XRES*. This is signalled in the body (authResult: "AUTHENTICATION_FAILURE"), not as an HTTP error. Common causes:

  • The UE's credentials (Ki/OPc) do not match those provisioned in the backend.
  • The RAND/AUTN or RES* were altered in transit, or the AMF/AUSF disagree on the serving network name (which would produce a mismatched vector).
  • A malformed/non-hex resStar is treated as a mismatch.

The AUSF logs AUSF 5G-AKA authentication FAILED for {supi}: RES* mismatch.

Confirmation returns 404 CONTEXT_NOT_FOUND​

The authCtxId in the PUT request matches no active context. Contexts are deleted after any confirmation (success or failure) and are lost on AUSF restart. The AMF must re-initiate authentication from POST .../ue-authentications.

Initiation returns 500 SYSTEM_FAILURE​

Either the UDM is unreachable at udm_uri, or the UDM returned a malformed authentication vector (missing/non-hex rand, xresStar, or kausf, or a missing autn). Verify UDM connectivity and that the UDM's vector generation is healthy. The AUSF logs AUSF auth failed ... with the reason, or AUSF auth failed: malformed authentication vector from UDM.

AUSF not discoverable / NRF status shows not registered​

Check GET /api/status/nrf and the omni_ausf_nrf_registration_status metric. Verify nrf_uri is correct (note the runtime default caveat in the configuration reference) and reachable, then force re-registration with POST /api/oam/nrf/reregister.

Growing active context count​

In-flight authentication contexts should return to near zero at rest. Contexts are removed on confirmation, delete, or deregister. If the AMF abandons authentications without confirming, those contexts are automatically garbage-collected by the periodic context reaper once they exceed context_ttl_seconds (default 3600 seconds); the reaper sweeps every context_reap_interval_ms (default 60000 ms). Stale contexts therefore clear on their own after the TTL without operator intervention.

If you need to inspect or clear contexts sooner, use the OAM API: GET /api/status/nf or GET /api/statistics for the live counts, GET /api/ausf_sessions to list them, and DELETE /api/ausf_sessions/{id} (or POST /api/ausf_sessions to clear all) to remove them immediately. The omni_ausf_active_contexts_count gauge tracks this count directly (it is emitted on context create, delete, and each reaper sweep), so you can watch it in Prometheus as well as via the OAM API. If the count climbs steadily faster than the TTL can drain it, check whether the AMF is repeatedly initiating authentications it never confirms.

Last updated on