Troubleshooting: Datastore Fails to Save in New Experience

Version Affected: 19.07.01 and later
 
 

Overview

Saving or creating a datastore in New Experience can fail for more than one distinct reason.

• See Cause 1 - Duplicate Datastore Name Across Appliance Types
• See Cause 2 - Expired Certificate Serial Number in globalsettings.json

These causes are not related, so a fix for one cause will not resolve the others.

 

In this article

• Cause 1: Duplicate Datastore Name Across Appliance Types
• Cause 2: Expired Certificate Serial Number in globalsettings.json

Cause 1: Duplicate Datastore Name Across Appliance Types

When multiple appliances have had their Appliance Type changed in Cloud Reports to unique names, saving a datastore in New Experience can fail with an error. Reviewing the nlog file containing the current date, under D:\Secureauth\ApplicationApi, shows an entry similar to "[Error] Error at /v1/data_stores. Exception: IdP.Application.BLL.Exceptions.CloudCallException: Unprocessable Entity". Duplicate datastore names cannot exist across Appliance Types: if two Appliance Types are named, for example, Dev-1 and Dev-2, and a datastore named SecureAuth-AD already exists under Dev-1, you cannot save a datastore with that same name under Dev-2.

Resolution 1:

To resolve this:

Ensure the datastore is not being saved with the same name across multiple appliances — rename the new datastore, or reuse the existing one instead of creating a duplicate under a different Appliance Type.

Cause 2: Expired Certificate Serial Number in globalsettings.json

New Experience datastore creation can also fail with an unhandled exception during the SecureStorage API's startup: System.ArgumentNullException: Value cannot be null. (Parameter 's'), thrown from DataProtectionConfiguration.ConfigureDataProtection when it calls Convert.FromBase64String. This happens when D:\secureauth\globalsettings.json still contains the serial number of an expired or invalid certificate: ConfigureDataProtection() receives idPCertificateBase64 as null, and the null value is what causes Convert.FromBase64String to throw.

Resolution 2:

To resolve this:

Update every instance of the old certificate's serial number in globalsettings.json with the new certificate's serial number, and replace the IssuerDn value with:

CN=SecureAuth Intermediate Certificate Authority X1, OU=Certificate Services, OU=(c) 2024 SecureAuth Corporation - For Authorized Use Only, O=SecureAuth Corporation, L=Irvine, S=California, C=US

Special Considerations

To gather more detail while diagnosing Cause 2 above (the certificate serial number / SecureStorage API startup failure), enable stdout logging: open D:\SecureAuth\SecureStorageApi\web.config and set stdoutLogEnabled="true", reproduce the issue by creating a new datastore, then collect the stdout logs from D:\SecureAuth\SecureStorageApi\logs.


 

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.