Return
-
Title
How to Change the ActiveDirectory Certificate For The PMUser and PMHelpdesk sites after Expiration -
Description
If the certificate for ActiveDirectory expires, the PMUser and PMHelpdesk sites will fail to load generating error: System error has occurred. For more information, view the event log. See Screenshot: Browser Error
The Password Manager Event Log also contains this error:
Result: CriticalErrorInfo:System.ServiceModel.EndpointNotFoundException: There was no endpoint listening at net.pipe://127.0.0.1/QPM.Service.Services.UserService that could accept the message. This is often caused by an incorrect address or SOAP action. See InnerException, if present, for more details. ---> System.IO.PipeException: The pipe endpoint 'net.pipe://127.0.0.1/QPM.Service.Services.UserService' could not be found on your local machine.--- End of inner exception stack trace ---Server stack trace:at System.ServiceModel.Channels.PipeConnectionInitiator.GetPipeName(Uri uri, IPipeTransportFactorySettings transportFactorySettings)at System.ServiceModel.Channels.NamedPipeConnectionPoolRegistry.NamedPipeConnectionPool.GetPoolKey(EndpointAddress address, Uri via)at System.ServiceModel.Channels.ConnectionPoolHelper.TakeConnection(TimeSpan timeout)at System.ServiceModel.Channels.ConnectionPoolHelper.EstablishConnection(TimeSpan timeout)at System.ServiceModel.Channels.ClientFramingDuplexSessionChannel.OnOpen(TimeSpan timeout)at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout)at System.ServiceModel.Channels.ServiceChannel.OnOpen(TimeSpan timeout)at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout)at System.ServiceModel.Channels.ServiceChannel.CallOnceManager.CallOnce(TimeSpan timeout, CallOnceManager cascade)at System.ServiceModel.Channels.ServiceChannel.EnsureOpened(TimeSpan timeout)at System.ServiceModel.Channels.ServiceChannel.Call(String action, Boolean oneway, ProxyOperationRuntime operation, Object[] ins, Object[] outs, TimeSpan timeout)at System.ServiceModel.Channels.ServiceChannelProxy.InvokeService(IMethodCallMessage methodCall, ProxyOperationRuntime operation)at System.ServiceModel.Channels.ServiceChannelProxy.Invoke(IMessage message)Exception rethrown at [0]:at System.Runtime.Remoting.Proxies.RealProxy.HandleReturnMessage(IMessage reqMsg, IMessage retMsg)at System.Runtime.Remoting.Proxies.RealProxy.PrivateInvoke(MessageData& msgData, Int32 type)at QPM.Service.Interfaces.Services.IWorkflowService.GetState(WorkflowRequest request, String scenarioShortName, String activityInstanceName)at QPM.UI.Common.MVC.Controllers.HomeController.GetViewModel(Nullable`1 commandName, RuntimeBase runtime)at QPM.UI.Common.MVC.Controllers.HomeController.Index()at lambda_method(Closure , ControllerBase , Object[] )at System.Web.Mvc.ReflectedActionDescriptor.Execute(ControllerContext controllerContext, IDictionary`2 parameters)at System.Web.Mvc.ControllerActionInvoker.InvokeActionMethod(ControllerContext controllerContext, ActionDescriptor actionDescriptor, IDictionary`2 parameters)at System.Web.Mvc.Async.AsyncControllerActionInvoker.c__DisplayClass39.b__33()at System.Web.Mvc.Async.AsyncControllerActionInvoker.b__49()at System.Web.Mvc.Async.AsyncControllerActionInvoker.b__49()at System.Web.Mvc.Async.AsyncControllerActionInvoker.b__36(IAsyncResult asyncResult)at System.Web.Mvc.Async.AsyncControllerActionInvoker.c__DisplayClass2a.b__20()at System.Web.Mvc.Async.AsyncControllerActionInvoker.b__22(IAsyncResult asyncResult)How is a new certificate selected to resolve this issue?
-
Cause
The PMUser and PMHelpdesk websites are attempting to use the expired certificates for their WCF connections back to the Password Manager Service and are unable to authenticate. -
Resolution
To resolve the issue, locate and delete the WcfConnectionSettings.xml files associate with both the PMUser and PMHelpdesk websites. This will prompt the corresponding site to reload and recreate the file, asking for a new certificate at the same time. See Screenshot: Reinitialize Website
For the PMUser website, locate the follow file to delete:
5.7.1 and later:
%Program Files%\One Identity\Password Manager\Web\User\App_Data\WcfConnectionSettings.xml- Launch the web browser and navigate to http://server/PMUser and select a new certificate in the drop down
- Input the IP Address of the Password Manager Server or leave at 127.0.0.1 if this is the same server
- Select the appropriate certificate
- Click Save
For the PMHelpdesk website, locate the follow file to delete:5.7.1 and later:
%Program Files%\One Identity\Password Manager\Web\HelpDesk\App_Data\WcfConnectionSettings.xml- Launch the web browser and navigate to http://server/PMHelpdesk and select a new certificate in the drop down
- Input the IP Address of the Password Manager Server or leave at 127.0.0.1 if this is the same server
- Select the appropriate certificate
- Click Save
NOTE:
The newly added certificate must match the one entered in the Admin site: PMAdmin-> general settings-> Reinitialization (see screen shot)
-
Attachments
