Troubleshooting: "Keyset Does Not Exist" and Related Invalid User Errors

Version Affected: the version range differs by cause, noted individually below.
 
 

Overview

Users see "Invalid User" and cannot log in to a realm, with the Error log showing a Keyset does not exist exception (sometimes shown as a SAML error instead). There are several independent causes:

• See Cause 1 - The realm's own certificate private key is missing, or the identity running the realm cannot read it.
• See Cause 2 - The SAML signing certificate's private key is missing, or the identity running the realm cannot read it.
• See Cause 3 - A known defect on version 9.0.2 when saving certain settings.

These causes are not related, so a fix for one will not resolve another.

 

In this article

• Cause 1: Realm certificate private key inaccessible
• Cause 2: SAML signing certificate private key inaccessible
• Cause 3: Known defect on version 9.0.2

Cause 1: Realm certificate private key inaccessible

Applies to all versions.

The identity that the realm is running under (for example, NETWORK SERVICE or SecureAuth0Pool) lacks read permission to the private key of the realm's certificate, or the private key is missing entirely.

Resolution 1:

To resolve this:

1. Open the Admin Console and go to the System Info tab of the affected realm.
2. Scroll down to the License Info section and note the Cert Serial Nbr, as shown below.

3. Open the Certificates console on the Identity Platform (IdP) server from the Start Menu.
4. Locate the certificate with the matching serial number, as shown below.

5. Double-click the certificate and confirm a private key exists, as shown below.

6. Right-click the certificate, select All Tasks, then Manage Private Keys.
7. Grant Read access to the following accounts:

• NETWORK SERVICE
• Authenticated Users
• SecureAuth0Pool (typed as IIS AppPool\SecureAuth0Pool)

8. Some realms run in non-standard Application Pools, or App Pools that use different identities than those listed above. To check, open IIS Manager and click Application Pools in the left-hand pane, then right-click each pool and select View Applications to confirm realms are assigned to the correct pool, and correct as necessary. Most realms (1 to 998) run under the .NET v4.5 pool using NETWORK SERVICE as the identity. The exceptions are SecureAuth0, Admin, and IdpConfigurator, which run under SecureAuth0Pool, or any realm that has been configured to run under a custom Application Pool.
9. If a custom Application Pool and/or identity is in use, add that identity to the private key permissions in the step above. An Application Pool running as ApplicationPoolIdentity can be added by prefixing the pool name with IIS AppPool\, for example IIS AppPool\MyAppPoolName.

A slightly different version of this error, "Object reference not set to an instance of an object," is covered separately: Encryption.DecryptRSAUTF8 exception: Object reference not set to an instance of an object.

Cause 2: SAML signing certificate private key inaccessible

Applies to all versions.

Users see the generic error "Error has been logged" when accessing a SAML realm. The error logs show an exception similar to:

SAML20SPInit exception error: Keyset does not exist

This is most often seen on Windows SSO realms, but can happen on regular realms too. Unlike Cause 1, this is specifically about the certificate used for SAML signing, not the realm's own certificate — the IdP cannot access the SAML signing certificate's private key, either because it is missing or because the identity running the realm does not have permission to use it.

Resolution 2:

To resolve this:

1. On the Post Auth tab, check which certificate is in use for SAML signing.
2. Open the Certificates console (Certlm.msc) and confirm that the certificate exists on this server.
3. Assuming the certificate exists, right-click it, select All Tasks, then Manage Private Keys.
4. For regular realms, grant read rights to IIS AppPool\SecureAuth0Pool and Network Service.
5. If you are using Windows SSO, Authenticated Users also needs read permission.
6. If the Application Pool is running as a non-standard identity, that identity needs read permission as well.

Cause 3: Known defect on version 9.0.2

Applies to version 9.0.2.

The error "Keyset does not exist" appears in the error logs, or a user cannot log in despite a correct service account username and password, after saving a valid service account username and password on the Data tab — the realm then shows "Invalid User" when accessed. This can also happen after saving the API ID and Key, the Validation and Decryption Key in Token Settings, or the OAuth Client ID and Client Secret.

Resolution 3:

This is fixed in a 9.0.2 hotfix. If you are on an affected 9.0.2 build, upgrade to the hotfixed build, or to a later release line, to resolve this.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.