Troubleshooting: Realm Shows "Invalid User" Error for All Users After Upgrade

Version Affected: All
 
 

Overview

This article explains two causes of a previously working realm showing Invalid User for all users, after upgrading to SecureAuth version 9.x or later.

• See Cause 1 - If the realm's Service Account is entered entirely in the account-name box, in DomainName/ServiceAccountName format.
• See Cause 2 - If the connectionPassword in the realm's web.config shows "Bad Data: Certificate was not found."

These causes are not related, so a fix for one cause will not resolve the other cause.

 

In this article

• Cause 1: Service Account Entered in the Wrong Format
• Cause 2: Certificate Reference Lost After Upgrading

Cause 1: Service Account Entered in the Wrong Format

The realm's Service Account field is split into two boxes separated by an @ — the account name, then the domain. On this realm, the entire DomainName/ServiceAccountName value has been entered in the account-name box, with the domain box left empty. This format was acceptable before version 9.x, but 9.x and later require the account name and domain to be entered separately.

Resolution 1:

To resolve this:

1. In the Admin Console, go to the realm's Data tab, then to the Membership Connection Settings section.
2. In the Service Account field, enter only the account name in the first box, and the domain in the box after the @.
   
3. Click Test Connection at the bottom of the Membership Connection Settings section. If it returns Connection Successful, the realm should now be fully functional.

Cause 2: Certificate Reference Lost After Upgrading

SecureAuth further protects passwords by encrypting them within the encrypted web.config. This can surface after the web.config is modified for the first time following the upgrade, so an unrelated change can appear to trigger the issue. The realm may not be affected immediately, and not all realms may be affected.

To confirm this is the cause:

1. In the Admin Console, open the affected realm and click the System Info tab.
2. Decrypt the web.config.
3. Open the web.config and search for connectionPassword.
4. If it shows "Bad Data: Certificate was not found. please check web.config for serialnumber," continue with the resolution below.

Resolution 2:

To resolve this:

1. In the Admin Console, open the realm.
2. Click System Info, scroll to the License Info section, and click Select Cert.
3. Pick a valid certificate.
4. Click Data.
5. Enter the datastore username and password, then click Save.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.