Troubleshooting: Hashed or Encrypted Passwords Are Not Supported With Auto-Generated Keys

Version Affected: 8.0-19.07
 
 

Overview

When a realm uses an SQL data store with Password Format set to Hashed or Encrypted, a configuration error occurs, and the realm logs show: Hashed or Encrypted passwords are not supported with auto-generated keys.

Cause

By default, realms are configured to auto-generate their Validation and Decryption keys, which means IIS generates new encryption keys every time the worker process starts. That's a problem when those keys are used to hash or encrypt passwords in the data store, because the result would never evaluate the same way twice -- and if multiple realms share the same data store, they'd end up with different decryption keys from each other. To prevent this, the combination is blocked.

Resolution:

To resolve this:

1. On the realm, go to the Post Auth tab, and under Machine Key, click Generate New Keys to set static Validation and Decryption keys.
2. Save the realm.
3. If multiple realms use the same data store, copy the same Validation Key and Decryption Key values to those realms as well.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.