Bug 1024392 - GDBus.Error:org.freedesktop.PolicyKit1.Error.Failed: An authentication agent already exists for the given subject
GDBus.Error:org.freedesktop.PolicyKit1.Error.Failed: An authentication agent ...
Product: Fedora
Classification: Fedora
Component: mate-desktop (Show other bugs)
x86_64 Linux
unspecified Severity medium
: ---
: ---
Assigned To: Dan Mashal
Fedora Extras Quality Assurance
Depends On:
  Show dependency treegraph
Reported: 2013-10-29 11:00 EDT by Brian J. Murrell
Modified: 2013-10-30 14:21 EDT (History)
25 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: 657006
Last Closed: 2013-10-30 05:07:00 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Brian J. Murrell 2013-10-29 11:00:08 EDT
+++ This bug was initially created as a clone of Bug #657006 +++

Description of problem:

During login to the MATE desktop this error pops up:

GDBus.Error:org.freedesktop.PolicyKit1.Error.Failed: An authentication agent already exists for the given subject

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1. Install F19
2. Add the MATE yum group
3. Log out and log backk in to MATE desktop
Actual results:
You will get a dialog with the above error

Expected results:
No dialog

Additional info:

I noticed that this error is coming from lxpolkit.  When I acknowledge the dialog, lxpolkit process goes away.

lxpolkit was added by the MATE yum group.

--- Additional comment from Reilly Hall on 2010-12-11 12:17:51 EST ---

I am getting this same error on one of my systems that too is running Fedora 14 x64 LXDE.  I would be willing to provide more information if requested.

--- Additional comment from Dan O'Brien on 2010-12-11 12:27:42 EST ---

Is this bug dead?  I've seen no follow up whatsoever.  And I'm still getting this error as is this other commenter.  HELLO. IS THIS THING ON?

--- Additional comment from Richard Shaw on 2010-12-14 21:01:27 EST ---

I'm getting the same error on two F14 x86_64 installs.

--- Additional comment from Richard Shaw on 2010-12-14 21:02:02 EST ---

--- Additional comment from Richard Shaw on 2010-12-15 09:31:18 EST ---

I believe this was caused during an update and is not isolated to F14. I used LXDE as my desktop for my MythTV machine and I remember seeing an error like this pop-up at some point on F13 x86_64. I can't be sure if it was the exact same error as the system auto-started Myth and I never investigated it further since I was already planning a fresh install of F14.

--- Additional comment from Richard Shaw on 2011-01-03 13:41:08 EST ---

I think I found the problem. The solution is so go into "Preferences->Desktop Session Settings" and un-check "PolicyKit Authentication Agent" as LXDE runs it's own LXPolKit Authentication Agent.

--- Additional comment from Till Bubeck on 2011-01-04 02:38:06 EST ---

I can confirm, that the alert box is not shown anymore with the fix from comment #6. Additionally I do not see anything broken by disabling the PolicyKit Authentication Agent.


--- Additional comment from Richard Shaw on 2011-01-04 08:51:20 EST ---

I'm out of my league here but I'll ask a few questions...

Are the session "services" (for lack of a better description) DE dependent? If so, then I think PolicyKit Auth. Agent should be disabled for LXDE by default.

--- Additional comment from Christoph Wickert on 2011-01-08 06:13:08 EST ---

We need an agent but it does not matter which one this it. IMHO each desktop environment should use it's own default agent. The problem is that /etc/xdg/autostart/polkit-gnome-authentication-agent-1.desktop only contains "NotShowIn=KDE;" and lacks "LXDE".

I already suggested that change back in April 2010 on the desktop-mailing list [1] but the GNOME maintainers refused. Instead they suggested to hardcode the agent somewhere. This was part of the "PolkitAgentReorg" feature [2] that never happened.

IMHO this feature is useless: People should be free to use whatever agent they want. They still might want to use polkit-gnome in LXDE because it has more features (but also more dependencies). Xfce doesn't have xfce4-polkit or alike. We should not and we cannot decide for the users, we should focus on providing a reasonable default configuration that works out of the box and does not throw errors.

David, does that sound reasonable? Can I go ahead and make that NotShowIn change in polkit-gnome?

What I'd like to know from all you bug reporters: Is there anybody who did a fresh install of Fedora 14 or installed the F14 LXDE spin or did you all upgrade? If you upgraded, polkit-gnome was already installed and lxpolkit was installed in addition to it because it is a new package in F14. If you did a fresh install lxpolkit should have fulfilled the requirement for "PolicyKit-authentication-agent" (a virtual provides that is provided by lxpolkit, polkit-gnome and kdebase), so polkit-gnome should not have been pulled in. Something might have an explicit requirement for one or the other agent hardcoded, this would be a bug in packaging but then.

Last but not least I'd like to invite all LXDE users to join our Fedora LXDE mailing list at http://lists.fedoraproject.org/pipermail/lxde/
This is the right place to talk about issues like this one. I just found this bug by accident.

[1] http://lists.fedoraproject.org/pipermail/desktop/2010-April/006091.html
[2] http://fedoraproject.org/wiki/Features/PolkitAgentReorg

--- Additional comment from Dan O'Brien on 2011-01-08 08:05:30 EST ---

I did a fresh install of the F14 LXDE (64 bit) and encountered this problem.

--- Additional comment from Christoph Wickert on 2011-01-08 08:35:57 EST ---

OK, in order to find out what pulled in polkit-gnome
- please try to uninstall it with yum. If there are no deps and it will uninstall, you don't need to confirm. If there are deps, please tell us.
- please attach the output of rpm -qa --last to this ticket

Thanks for your help.

--- Additional comment from Dan O'Brien on 2011-01-08 08:43:34 EST ---

/home/dmobrien: rpm -q polkit-gnome
/home/dmobrien: sudo rpm -e polkit-gnome
error: Failed dependencies:
	PolicyKit-gnome is needed by (installed) blueman-1.21-6.fc14.x86_64
	polkit-gnome is needed by (installed) gnome-session-2.32.0-1.fc14.x86_64

--- Additional comment from Dan O'Brien on 2011-01-08 08:44:18 EST ---

my rpm -qa --last listing

--- Additional comment from Till Bubeck on 2011-01-08 09:05:28 EST ---

I also did a fresh install from standard FC14 DVD and afterwards did a "yum groupinstall LXDE".

--- Additional comment from Christoph Wickert on 2011-01-08 09:46:53 EST ---

Thanks for the feedback.

(In reply to comment #12)
>  PolicyKit-gnome is needed by (installed) blueman-1.21-6.fc14.x86_64

filed as bug 668157

>  polkit-gnome is needed by (installed) gnome-session-2.32.0-1.fc14.x86_64

filed as bug 668156

--- Additional comment from  on 2011-02-13 13:24:32 EST ---

I did as in comment 6 and 7 thanks guys it worked

--- Additional comment from Dan O'Brien on 2011-02-13 15:08:42 EST ---

I do 6 but it keeps coming back set.

--- Additional comment from Christoph Wickert on 2011-02-13 15:38:12 EST ---

Please give me the output of 
cat ~/.config/autostart/lxpolkit.desktop and
cat ~/.config/autostart/polkit-gnome-authentication-agent-1.desktop

--- Additional comment from Christoph Wickert on 2011-02-13 15:47:50 EST ---

I have filed bug 657006 against polkit-gnome now.

--- Additional comment from Dan O'Brien on 2011-02-13 18:47:42 EST ---

/home/dmobrien: cat ~/.config/autostart/lxpolkit.desktop
cat: /home/dmobrien/.config/autostart/lxpolkit.desktop: No such file or directory
/home/dmobrien: cat ~/.config/autostart/polkit-gnome-authentication-agent-1.desktop
[Desktop Entry]
Name=PolicyKit Authentication Agent
Name[ar]=مدير الاستيثاق PolicyKit
Name[be]=PolicyKit - аґент аўтэнтыфікацыі
Name[bn_IN]=PolicyKit অনুমোদনের এজেন্ট
Name[ca]=Agent d'autenticació del PolicyKit
Name[cs]=Ověřovací agent PolicyKit
Name[da]=Godkendelsesprogrammet PolicyKit
Name[de]=Legitimationsdienst von PolicyKit
Name[el]=Πράκτορας πιστοποίησης PolicyKit
Name[en_GB]=PolicyKit Authentication Agent
Name[es]=Agente de autenticación de PolicyKit
Name[eu]=PolicyKit autentifikatzeko agentea
Name[fr]=Agent d'authentification de PolicyKit
Name[gl]=Axente de autenticación PolicyKit
Name[gu]=PolicyKit સત્તાધિકરણ એજન્ટ
Name[hi]=PolicyKit प्रमाणीकरण प्रतिनिधि
Name[hu]=PolicyKit hitelesítési ügynök
Name[it]=Agente di autenticazione per PolicyKit
Name[ja]=PolicyKit 認証エージェント
Name[kn]=PolicyKit ದೃಢೀಕರಣ ಮಧ್ಯವರ್ತಿ
Name[lt]=PolicyKit tapatybės nustatymo agentas
Name[ml]=പോളിസിക്കിറ്റ് ഓഥന്റിക്കേഷന്‍ ഏജന്റ്
Name[mr]=PolicyKit ऑथेंटीकेशन एजेंट
Name[or]=PolicyKit ବୈଧିକରଣ ସଦସ୍ୟ
Name[pa]=ਪਾਲਸੀਕਿੱਟ ਪਰਮਾਣਕਿਤਾ ਏਜੰਟ
Name[pl]=Agent uwierzytelniania PolicyKit
Name[pt]=Agente de Autenticação PolicyKit
Name[pt_BR]=Agente de autenticação PolicyKit
Name[sl]=PolicyKit program overjanja
Name[sv]=Autentiseringsagent för PolicyKit
Name[ta]=PolicyKit அங்கீகார முகவர்
Name[te]=పాలసీకిట్ ధృవీకరణ ప్రతినిధి
Name[th]=ตัวกลางสำหรับยืนยันตัวบุคคล PolicyKit
Name[uk]=Агент автентифікації PolicyKit
Name[zh_CN]=PolicyKit 认证代理
Name[zh_HK]=PolicyKit 驗證代理程式
Name[zh_TW]=PolicyKit 驗證代理程式
Comment=PolicyKit Authentication Agent
Comment[ar]=مدير الاستيثاق PolicyKit
Comment[be]=PolicyKit - аґент аўтэнтыфікацыі
Comment[bn_IN]=PolicyKit অনুমোদনের এজেন্ট
Comment[ca]=Agent d'autenticació del PolicyKit
Comment[cs]=Ověřovací agent PolicyKit
Comment[da]=Godkendelsesprogrammet PolicyKit
Comment[de]=Legitimationsdienst von PolicyKit
Comment[el]=Πράκτορας πιστοποίησης PolicyKit
Comment[en_GB]=PolicyKit Authentication Agent
Comment[es]=Agente de autenticación de PolicyKit
Comment[eu]=PolicyKit autentifikatzeko agentea
Comment[fr]=Agent d'authentification de PolicyKit
Comment[gl]=Axente de autenticación PolicyKit
Comment[gu]=PolicyKit સત્તાધિકરણ એજન્ટ
Comment[hi]=PolicyKit प्रमाणीकरण प्रतिनिधि
Comment[hu]=PolicyKit hitelesítési ügynök
Comment[it]=Agente di autenticazione per PolicyKit
Comment[ja]=PolicyKit 認証エージェント
Comment[kn]=PolicyKit ದೃಢೀಕರಣ ಮಧ್ಯವರ್ತಿ
Comment[lt]=PolicyKit tapatybės nustatymo agentas
Comment[ml]=പോളിസിക്കിറ്റ് ഓഥന്റിക്കേഷന്‍ ഏജന്റ്
Comment[mr]=PolicyKit ऑथेंटीकेशन एजेंट
Comment[or]=PolicyKit ବୈଧିକରଣ ସଦସ୍ୟ
Comment[pa]=ਪਾਲਸੀਕਿੱਟ ਪਰਮਾਣਕਿਤਾ ਏਜੰਟ
Comment[pl]=Agent uwierzytelniania PolicyKit
Comment[pt]=Agente de Autenticação PolicyKit
Comment[pt_BR]=Agente de autenticação PolicyKit
Comment[sl]=PolicyKit program overjanja
Comment[sv]=Autentiseringsagent för PolicyKit
Comment[ta]=PolicyKit அங்கீகார முகவர்
Comment[te]=పాలసీకిట్ ధృవీకరణ ప్రతినిధి
Comment[th]=ตัวกลางสำหรับยืนยันตัวบุคคล PolicyKit
Comment[uk]=Агент автентифікації PolicyKit
Comment[zh_CN]=PolicyKit 认证代理
Comment[zh_HK]=PolicyKit 驗證代理程式
Comment[zh_TW]=PolicyKit 驗證代理程式

--- Additional comment from Susi Lehtola on 2011-05-06 12:45:58 EDT ---

I just got the same error in XFCE4 on a fresh install of F15.

--- Additional comment from Christoph Wickert on 2011-05-21 14:35:27 EDT ---

Can you give us more details, Jussi? What polkit agents do ypu have installed and which are running? Is gnome-shell installed? It ships yet another agent.

--- Additional comment from Gilboa Davara on 2011-05-27 10:37:48 EDT ---

Seeing the same with Fedora 15 / x86_64 / XFCE installed.
gnome-shell installed.
How can I check which polkit agents are active?

--- Additional comment from Christoph Wickert on 2011-05-27 10:47:34 EDT ---

Look at the files in /etc/xdg/autostart or ~/.config/autostart. 'ps -A| grep pol' also helps but I have no idea how the new agent that is included in gnome-shell is called.

--- Additional comment from Gilboa Davara on 2011-05-27 10:57:40 EDT ---

OK. I looked the xfce startup configuration and it had two polkit agents: LXPolKit and PolicyKit.

Disabling LXPolKit solved the problem.

--- Additional comment from Jos Vos on 2011-09-08 12:26:10 EDT ---

Where did you find this?  On F15 with all updates (and GNOME / LXE / Xfce installed) I get this error on every Xfce session.

--- Additional comment from Christoph Wickert on 2011-09-08 13:09:30 EDT ---

In the session properties. For LXDE this is lxsession-edit, for Xfce it is xfce4-session-settings and for GNOME is is in gnome-session-properties.

--- Additional comment from Jos Vos on 2011-09-12 09:38:23 EDT ---

OK, like Gilboa I had in my Xfce session autostart list both PolicyKit and LXPolKit enabled, so I disabled LXPolKit.

--- Additional comment from bob mckay on 2011-11-28 22:31:25 EST ---

Still present in F16. This is a bit of a disaster for server systems, because gnome and a lightweight such as lxde are both needed (most users seem to prefer gnome for local sessions; but in my experience gnome3 is pretty much unusable for remote sessions). Requiring users to disable a security feature (i.e. lxpolkit) seems to be asking for trouble down the line.

--- Additional comment from Christoph Wickert on 2011-11-29 03:35:00 EST ---

Bob, we are not asking anybody to disable a security feature but to decide which of the two programs that provide exactly the same functionality they want to use.

--- Additional comment from bob mckay on 2011-11-29 10:25:36 EST ---

Christoph, I know that's not what you're intending to do, and there's a strong possibility that I'm misunderstanding. But if people become accustomed to turning off lxpolkit on systems which have gnome installed, isn't there a high likelihood that they will think it is also the right thing to do on systems built with lxde only? And if the automatic loading of gnome-polkit ever gets disabled in a future version of fedora, won't the same problems arise even on systems built with gnome? My concern was that this falls into the human factors side of security, setting up a situation where users with limited knowledge are likely to default into unsafe practices.

--- Additional comment from Linux Zombie on 2012-01-11 12:18:38 EST ---

Long post incoming.. This really is an issue.  I created an account just to post this.  I've been scurrying the web off and on trying to find a solution to this.  I have done fresh installs of F16 but using Xfce (moved over from Ubuntu Unity = yuk).

Anyways, I can say that initially, it was working fine (fresh install) but at some point after installing other packages and updates, this broke.  Info:

- Fedora 16 Xfce spin 64-bit
- /etc/xdg/autostart/xfce-polkit-gnome-authentication-agent-1.desktop exists but not a ~/.config/... equivalent and contains:
    [Desktop Entry]
    Name=PolicyKit Authentication Agent
- gnome-shell is NOT installed
- ps -A | grep pol outputs processes: polkitd, polkit-gnome-au
- yum info polkit-gnome outputs:
    Loaded plugins: langpacks, presto, refresh-packagekit
    Installed Packages
    Name        : polkit-gnome
    Arch        : x86_64
    Version     : 0.104
    Release     : 2.fc16
    Size        : 356 k
    Repo        : installed
    From repo   : koji-override-0
    Summary     : PolicyKit integration for the GNOME desktop
- xfce4-session-settings does have the check mark for "Policy Kit Authentication Agent

Last to mention, I "do" run vncserver and remote X into the box.

This last piece "might" shed some light.  When I had a GUI session on the "head" and a vnc client separate remote X session.  The PolKit would popup the root password prompt on the MAIN head's GUI when it should be asking on the vnc client remote session!  However, I changed the run-time boot to just multi-user (no initial gui on the "head").. that seems to have solved the issue temporarily (started getting the polkit prompt in the vnc clients), but then this stopped working again.. even without a "head" GUI.

My workaround is to not use the GUI firewall, Add/Remove Software, Software Update, etc.  Been just opening up a term window, su, then use yum (and firewall-tui).

--- Additional comment from Linux Zombie on 2012-01-11 12:44:09 EST ---

my error's slightly different.  If I try to run system-config-firewall, I get:

"org.fedoraproject.slip.dbus.service.PolKit.NotAuthorizedException.org.fedoraproject.config.firewall.auth: "

if I try to run gpk-application (Add/Remove Software), upon trying to install something, I get a slightly different error with this window:

"Authorization Failed - You have failed to provide correct authorization.  Please check any passwords or account settings."

before, I would get a prompt to enter the root password instead.

--- Additional comment from Fedora End Of Life on 2012-08-16 17:50:36 EDT ---

This message is a notice that Fedora 14 is now at end of life. Fedora 
has stopped maintaining and issuing updates for Fedora 14. It is 
Fedora's policy to close all bug reports from releases that are no 
longer maintained.  At this time, all open bugs with a Fedora 'version'
of '14' have been closed as WONTFIX.

(Please note: Our normal process is to give advanced warning of this 
occurring, but we forgot to do that. A thousand apologies.)

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, feel free to reopen 
this bug and simply change the 'version' to a later Fedora version.

Bug Reporter: Thank you for reporting this issue and we are sorry that 
we were unable to fix it before Fedora 14 reached end of life. If you 
would still like to see this bug fixed and are able to reproduce it 
against a later version of Fedora, you are encouraged to click on 
"Clone This Bug" (top right of this page) and open it against that 
version of Fedora.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events.  Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.

The process we are following is described here: 

--- Additional comment from Peter H. Jones on 2013-07-29 17:21:58 EDT ---

Getting this bug in Fedora 19. Here is the message in /var/log/messages:

Jul 29 16:58:29 mariehe /etc/gdm/Xsession[1301]: ** (lxpolkit:1652): WARNING **: Unable to register authentication agent: GDBus.Error:org.freedesktop.PolicyKit1.Error.Failed: An authentication agent already exists for the given subject

Can't change Status or Version.
Comment 1 Wolfgang Ulbrich 2013-10-29 17:42:14 EDT
That's a bit weird because lxpolkit isn't in mate comps group.
Can you attach the yum log of the groupinstall command?
yum history
yum history list <id>

Can you uninstall lxpolkit without removing a mate package?
Comment 2 Wolfgang Ulbrich 2013-10-29 17:43:51 EDT
yum history
yum history info <id>
Comment 3 Dan Mashal 2013-10-29 18:04:23 EDT
MATE does not install lxpolkit.

What DE did you have installed before you installed MATE?

What is the exact command you used to install mate?

What is the output of "repoquery --whatrequires lxpolkit"?
Comment 4 Brian J. Murrell 2013-10-29 23:02:04 EDT
Hrm.  So the things you gave me to investigate have shed some light.  I thought I was sure lxpolkit came with MATE but I was mistaken.  It seems to have come as a dependency of blueman:

$ repoquery --whatrequires lxpolkit

which is a dependency of cinnamon:

$ repoquery --whatrequires blueman

This dependency of cinnamon on blueman seemed to have happened when I got cinnamon-1.9.1-19.fc19.x86_64.

What is interesting though is that I was able to remove just lxpolkit and nothing else which is not surprising when you notice that blueman does not depend on lxpolkit:

$ rpm -q -R blueman
bluez >= 4.25
config(blueman) = 1.23-6.fc19
obex-data-server >= 0.4.3
pygtk2 >= 2.12
python >= 2.5
python(abi) = 2.7
rpmlib(CompressedFileNames) <= 3.0.4-1
rpmlib(FileDigests) <= 4.6.0-1
rpmlib(PartialHardlinkSets) <= 4.0.4-1
rpmlib(PayloadFilesHavePrefix) <= 4.0-1
rpmlib(PayloadIsXz) <= 5.2-1

But then why does repoquery --whatrequires lxpolkit say blueman requires it?
Comment 5 Wolfgang Ulbrich 2013-10-30 05:07:00 EDT
You can savely remove blueman because it doesn't work anymore in f20.
Blueman isn't ported to bluez5 and upstream is death.
A alternative for mate user is to use bluedevil from kde.
Comment 6 Wolfgang Ulbrich 2013-10-30 05:31:04 EDT
Sorry, i missread your fedora version, blueman do work in f19.
Comment 7 Rex Dieter 2013-10-30 07:55:59 EDT
blueman Requires: PolicyKit-authentication-agent

which has multiple providers including lxpolkit, mate-polkit, gnome-polkit, kde-polkit

(not sure why repoquery doesn't list them all)
Comment 8 Michael Schwendt 2013-10-30 13:45:11 EDT
> But then why does repoquery --whatrequires lxpolkit say blueman requires it?

Because it defaults to enabling option --alldeps, which means it checks whether anything depends on stuff _provided by_ lxpolkit. Nothing requires the package name "lxpolkit":

  $ repoquery --exactdeps --whatrequires lxpolkit

The dependency is only on the "PolicyKit-authentication-agent" capability of lxpolkit. 

  $ repoquery --whatrequires PolicyKit-authentication-agent

  $ repoquery --whatprovides PolicyKit-authentication-agent

Compare with:

  $ repoquery --whatrequires polkit-gnome

  $ repoquery --exactdeps --whatrequires polkit-gnome

"blueman" is gone in the second query. The first query only found that polkit-gnome may resolve a "PolicyKit-authentication-agent" requirement.

> (not sure why repoquery doesn't list them all)

Because the query is specifically about what depends on lxpolkit.

Note You need to log in before you can comment on or make changes to this bug.