2

I have a strange issue with the SDL Media Manager connector on 2013 SP1. I've had it all installed and working perfectly until recently.

The CME is sitting behind SSO and Core Services/Content Porter work correctly after being configured to authenticate against an LDAP directory. However the configuration of Core Service for LDAP seems to inadvertently knocked out Media Manager and for the life of me I can not figure out why. The Media Manager logs seem to state it can't find the certificate in the certificate store, yet no access rights have been changed.

Exception has been thrown by the target of an invocation. Unable to load the configuration from Scope number 1 in the configuration file D:\Apps\SDL\Tridion\config\TridionSTS.xml. Unable to load the certificate from the element "SigningCertificate". No valid certificate was found.

StackTrace Information Details:

Server stack trace: at System.ServiceModel.Channels.ServiceChannel.ThrowIfFaultUnderstood(Message reply, MessageFault fault, String action, MessageVersion version, FaultConverter faultConverter) at System.ServiceModel.Channels.ServiceChannel.HandleReply(ProxyOperationRuntime operation, ProxyRpc& rpc) at System.ServiceModel.Channels.ServiceChannel.Call(String action, Boolean oneway, ProxyOperationRuntime operation, Object[] ins, Object[] outs, TimeSpan timeout) at System.ServiceModel.Channels.ServiceChannelProxy.InvokeService(IMethodCallMessage methodCall, ProxyOperationRuntime operation) at System.ServiceModel.Channels.ServiceChannelProxy.Invoke(IMessage message)

Exception rethrown at [0]: at System.Runtime.Remoting.Proxies.RealProxy.HandleReturnMessage(IMessage reqMsg, IMessage retMsg) at System.Runtime.Remoting.Proxies.RealProxy.PrivateInvoke(MessageData& msgData, Int32 type) at Tridion.ExternalContentLibrary.Service.Client.ISessionAwareEclService.GetList(String parentItemUri, Int32 pageIndex, EclItemTypes itemTypes, IEnumerable`1 basedOnSchema) at Tridion.ExternalContentLibrary.UI.Model.Services.GeneralImpl.GetList(String id, Int32 pageIndex, Filter filter, Int32 columns) at Tridion.ExternalContentLibrary.UI.Model.Services.General.GetList(String id, Int32 pageIndex, Filter filter, Int32 columns) at SyncInvokeGetList(Object , Object[] , Object[] ) at System.ServiceModel.Dispatcher.SyncMethodInvoker.Invoke(Object instance, Object[] inputs, Object[]& outputs) at Tridion.Web.UI.Core.Extensibility.DataExtenderOperationInvoker.Invoke(Object instance, Object[] inputs, Object[]& outputs) at System.ServiceModel.Dispatcher.DispatchOperationRuntime.InvokeBegin(MessageRpc& rpc) at System.ServiceModel.Dispatcher.ImmutableDispatchRuntime.ProcessMessage5(MessageRpc& rpc) at System.ServiceModel.Dispatcher.ImmutableDispatchRuntime.ProcessMessage31(MessageRpc& rpc) at System.ServiceModel.Dispatcher.MessageRpc.Process(Boolean isOperationContextSet)

My assumption is, because Core Services is now using LDAP authentication from the SSO implementation it's caused Media Manager to try using a different username to access the certificates. Unfortunately the server itself is not part of a domain so adding that user would be tricky, but really after some ideas to atleast identify what the user is for which the MM connector is using.

Thanks

Martin

Improve this question

1 Answer 1

Reset to default
3

Be aware of the following:

  • Ensure that the certificates are placed in the right key store. They should be in the key store for Local Computer.

  • Ensure you have set READ permissions for the user which is running the Core Service on the certificate with the private key. This user usually is NETWORK SERVICE:

enter image description here

  • Ensure that the proper thumbprint is set in the SigningCertificate node in TridionSTS.xml and that in ExternalContentLibrary.xml the thumbprint of the SDL Certificate (usually called *.sdlmedia.com) is set.

  • Ensure that both certificates are also copied in the Certificates folder under Trusted Root Certification Authorities.

Improve this answer
6
  • Hi Raimond, That definitely is all correctly setup, as said it was previously working and has only recently stopped after enabling LDAP authentication for the Core Services.
    – Martin Herbert
    Oct 17, 2014 at 13:50
  • Hi Martin, Have you also checked Tridion\log\MediaManager\ExternalContentLibrary.log and or Tridion\bin\log\TridionSTS.log to see which user is connecting? Further, I might also be that LDAP impersonation runs under the account the IIS App Pool for Tridion is running under, so you could try that. Finally, the impersonating user should also be in the Exception logged. If not - run process monitor to see the actual user. In any case, that user has to have the access rights on the certificate, as you already know.
    – Raimond
    Oct 20, 2014 at 7:12
  • Still no luck unfortunately. Have checked both log files and neither of them provide any detail of the User trying to access to the certificates. Checking in Process Monitor, it seems to be NT AUTHORITY\NETWORK SERVICE being used against the Registry entry for the certificates, and I've double checked that account has access to both certificates. Also verified that same user account is what's assigned to the Tridion app pool. One strange thing though I do seem to be getting the following error in the STS logs.
    – Martin Herbert
    Nov 5, 2014 at 11:51
  • 2014-11-05T10:55:34 TcmServiceHost 97 The source was not found, but some or all event logs could not be searched. Inaccessible logs: Security. at System.Diagnostics.EventLog.FindSourceRegistration(String source, String machineName, Boolean readOnly, Boolean wantToCreate) at System.Diagnostics.EventLog.SourceExists(String source, String machineName, Boolean wantToCreate) at System.Diagnostics.EventLog.SourceExists(String source) at Tridion.Infrastructure.Logging.Logger.WriteToEventLog(EventLogEntryType severity, Exception exception)
    – Martin Herbert
    Nov 5, 2014 at 11:52
  • Check out this SO post: stackoverflow.com/questions/1274018/…. Having the right permissions on that log will probably log the user in the security event log :)
    – Raimond
    Nov 5, 2014 at 13:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.