Troubleshooting: CyberArk Credential Provider Returns Corrupted Ciphertext (NetPasswordSDK.dll Version Mismatch)

Version Affected: All
 
 

Overview

When using the CyberArk Credential Provider (CP) to manage a SecureAuth service account's password, the Credential Provider returns corrupted ciphertext instead of the correct password, which causes the service account to be locked.

Cause

The version of NetPasswordSDK.dll used by SecureAuth does not match the version expected by the CyberArk Credential Provider (CP).

Resolution:

1. Back up the existing D:\SecureAuth\SecureAuthX\bin\NetPasswordSDK.dll file.
2. Copy the NetPasswordSDK.dll file provided in the CyberArk Credential Provider's installation folder, and paste it in place of the file you backed up.
3. Edit the machine.config file for whichever .NET Framework bitness applies to your server:

• .NET Framework 4.x (64-bit): %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config
• .NET Framework 4.x (32-bit): %WINDIR%\Microsoft.NET\Framework\v4.0.30319\Config\machine.config

4. Inside the file's <configuration> tag, in the <runtime>/<assemblyBinding> section, add a binding redirect for NetPasswordSDK:

<configuration>
  <runtime>
    <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">
      <dependentAssembly>
        <assemblyIdentity name="NetPasswordSDK"
                publicKeyToken="40be1dbc8718670f"
                culture="neutral" />
        <bindingRedirect oldVersion="0.0.0.0-12.1.0.58"
                newVersion="12.6.0.0" />
      </dependentAssembly>
    </assemblyBinding>
  </runtime>
</configuration>

5. Confirm the publicKeyToken value matches CyberArk's NetPasswordSDK, which is 40be1dbc8718670f.
6. Confirm the newVersion value matches the actual four-part assembly version of the new DLL. A release may be labeled with only two parts (for example, "12.6"), but newVersion requires the full four-part version (for example, 12.6.0.0) — check the properties of your specific NetPasswordSDK.dll file to confirm its exact build version.

Special Considerations

If the binding redirect does not appear to take effect, verify your specific file's actual public key token by running sn -T NetPasswordSDK.dll in a Visual Studio Developer Command Prompt.

Following any SecureAuth Server upgrade, check machine.config again — an upgrade can deploy a newer NetPasswordSDK.dll version, and the existing binding redirect will need to be updated to match it.


 

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.