Running Fabric CA natively - Could not find default `PKCS11` BCCSP - hyperledger-fabric

Question

Attempting to configure HSM according to:
https://hyperledger-fabric-ca.readthedocs.io/en/release-1.4/users-guide.html#configuring-an-hsm
but trying to do so running the Fabric CA Server as a systemd service according to:
https://upcloud.com/community/tutorials/hyperledger-fabric-systemd/
I followed a combo of the above link and this link:
https://gist.github.com/AkshayCHD/f7c96175dca1e5ab8d5785a3af0d5692
BUT I built it with "GO_TAGS=pkcs11 make fabric-ca-server" according to this:
https://jira.hyperledger.org/browse/FAB-13458
I installed SoftHSM according to the below link and can initialize the token:
https://wiki.opendnssec.org/display/SoftHSMDOCS/SoftHSM+Documentation+v2#SoftHSMDocumentationv2-Download
I initialize the server before starting so I can edit the fabric-ca-server-config.yaml with the appropriate PKCS11 data.
I can start the server/service fine without PKCS11 but when I edit the fabric-ca-server-config.yaml file to the below it never works.
INTERESTINGLY when I switch the default to "SW" I receive:
Error: Failed to initialize BCCSP Factories: Failed initializing PKCS11.BCCSP %!s(): Could not initialize BCCSP PKCS11 [Failed initializing PKCS11 library /home/ubuntu/softhsm/SoftHSMv2/src/lib/.libs/libsofthsm2.so ForFabric: Could not get Slot List [pkcs11: 0x190: CKR_CRYPTOKI_NOT_INITIALIZED]]
BUT when I have "default: PKCS11" I get this error:
Could not find default PKCS11 BCCSP
I have read this https://jira.hyperledger.org/browse/FAB-9595 but AGAIN I'm not using Docker.
Any help or pointers in the right direction would be appreciated.
Relevant output:
bccsp:
default: PKCS11
pkcs11:
Library: /home/ubuntu/softhsm/SoftHSMv2/src/lib/.libs/libsofthsm2.so
Pin: 98765432
Label: ForFabric
hash: SHA2
security: 256
filekeystore:
# The directory used for the software file-based keystore
keystore: msp/keystore
sw:
hash: SHA2
security: 256
filekeystore:
# The directory used for the software file-based keystore
keystore: msp/keystore
fabric-ca-server:
Version: 2.0.0-snapshot-d780eb0
Go version: go1.13.5
OS/Arch: linux/amd64

Answer 1

After executing GO_TAGS=pkcs11 make fabric-ca-server, remember to remove the original fabric-ca-server binary and put the newly built binary in path/to/go/bin

Answer 2

The issue encountered was a combination of creating the tokens as one user and starting the service as another (sudo). Creating the token and starting the Fabric CA server as root (sudo -i) solved this issue.
root#ip-172-31-85-208:~/fab-ca/server# fabric-ca-server start -b
admin:adminpw 2020/01/10 17:57:31 [INFO] Configuration file location:
/root/fab-ca/server/fabric-ca-server-config.yaml 2020/01/10 17:57:31
[INFO] Starting server in home directory: /root/fab-ca/server
2020/01/10 17:57:31 [INFO] Server Version: 2.0.0-snapshot-d780eb0
2020/01/10 17:57:31 [INFO] Server Levels: &{Identity:2 Affiliation:1
Certificate:1 Credential:1 RAInfo:1 Nonce:1} 2020/01/10 17:57:31
[INFO] The CA key and certificate already exist 2020/01/10 17:57:31
[INFO] The key is stored by BCCSP provider 'PKCS11' 2020/01/10
17:57:31 [INFO] The certificate is at: /root/fab-ca/server/ca-cert.pem
2020/01/10 17:57:31 [INFO] Initialized sqlite3 database at
/root/fab-ca/server/fabric-ca-server.db 2020/01/10 17:57:31 [INFO] The
Idemix issuer public and secret key files already exist 2020/01/10
17:57:31 [INFO] secret key file location:
/root/fab-ca/server/msp/keystore/IssuerSecretKey 2020/01/10 17:57:31
[INFO] public key file location:
/root/fab-ca/server/IssuerPublicKey 2020/01/10 17:57:31 [INFO] The
Idemix issuer revocation public and secret key files already exist
2020/01/10 17:57:31 [INFO] private key file location:
/root/fab-ca/server/msp/keystore/IssuerRevocationPrivateKey 2020/01/10
17:57:31 [INFO] public key file location:
/root/fab-ca/server/IssuerRevocationPublicKey 2020/01/10 17:57:31
[INFO] Home directory for default CA: /root/fab-ca/server 2020/01/10
17:57:31 [INFO] Operation Server Listening on 127.0.0.1:9443
2020/01/10 17:57:31 [INFO] Listening on http://0.0.0.0:7054