Cytographic Exception.

[Jamie Clayton]

As part of my Windows Server 2008 R2 maintenance I upgraded my Vault software from

SQL 2005 to SQL 2008. (Moved the database via backup and restore)
Vault 4.1.4 to 5.0.2

I also upgraded my Finalbuilder software (and Server)
Final Builder v6.3.0.1816 to 6.3.0.1855
Final Builder Server v.6.3.0.731 to v6.3.0.773

Now the Vault web site and client both seem to have upgraded and work as per normal.

When I run the Final Builder Server Build Service I know it's just hooking into Vault.exe via command line and checking to see if there have been changes to a project friles (and firing off an automated process if required). The result however a constant stream of event logs and debuger processing trying to open on the server.

The event log error is
Faulting application name: vault.exe, version: 5.0.2.18753, time stamp: 0x4b04abbc
Faulting module name: KERNELBASE.dll, version: 6.1.7600.16385, time stamp: 0x4a5bdfe0
Exception code: 0xe0434f4d
Fault offset: 0x000000000000aa7d
Faulting process id: 0x1f4c
Faulting application start time: 0x01ca958f3087d392
Faulting application path: C:\Program Files (x86)\SourceGear\Vault Client\vault.exe
Faulting module path: C:\Windows\system32\KERNELBASE.dll
Report Id: 71355d4e-0182-11df-a7be-001a4d442ca4


The Vault event log also includes
An unhandled exception ('System.Security.Cryptography.CryptographicException') occurred in vault.exe [7852]. Just-In-Time debugging this exception failed with the following error: Debugger could not be started because no user is logged on. Check the documentation index for 'Just-in-time debugging, errors' for more information

For the time being I've switched off the "Build Service", till I get this resolved. Any ideas what causing this?

[Beth]

On the Final Builder server you can pull up the Vault GUI client and log in with the same account that Final Builder uses?

[Jamie Clayton]

Sorry about the delay replying.

I can login to vault.exe 5.0.2 with the credentials used on the build server.
I have also opened the final builder software that uses vault as a source control repository.

Is there a way to add further logging to find out what's going on?

I've updated to the latest software from Final Builder v6.3.0.1916.

[Beth]

What type of account do you have Final Builder running under? Is it a system account, a windows account, or something else? Can you login to Windows using the account that Final Builder runs under? What I'm asking about will have nothing to do with the Vault user used by Final Builder, just the Windows account used.

If you can login to Windows with the Final Builder user, then try running the Vault command line and login as the Vault user account that Final Builder uses to get files from Vault. Can you perform the same Get from the command line as what Final Builder needs?

[Jamie Clayton]

Beth,

Misunderstood your response, sorry. This makes more sense.

The Windows 2008 R2 services MMC has the following.

Final Builder 6 Build Service - Local Account
Final Builder 6 Logging Service - Local Account
Final Builder 6 Management Service - Local Account

Just researching how to open vault client with this account (run as) to confirm the behaviour.

[Jamie Clayton]

Will Vault 5.0.3.18802 address this issue?

I couldn't find an example of how to use cmd.exe + RunAs + Local Account online, so I could test the authentication. I attempted a number of manual command lines, but they all failed. I suspect run as local account is restricted due to the way it has been configured in the Microsoft operating system. My understanding of Local Account was that it had fairly "adminstrator" like privilages. Would you suggest the command to run to test this?

Sample attempts in cmd.exe and results.
a) runas /user:"Local Account" "C:\Program Files\SourceGear\Vault Client\vault.exe" - Promopts for a password, which doesn't exist. Msg: 1326 login failure
b) runas /TrustLevel:"Local Account" "C:\Program Files\SourceGear\Vault Client\vault.exe" Msg: 1260 blocked by group policy
c) runas /TrustLevel:"Basic Account" "C:\Program Files\SourceGear\Vault Client\vault.exe" Bad syntax

I can manually run Vault.exe on the server successfully.
Alternatively, have you got a suggested change to the service credentials?

[Jamie Clayton]

If I open Final Builder 6 (not the Build Service) as Administrator and open an existing project then execute a Vault command it works. Eg.

Example log entry:
Running Vault with command line : LISTFOLDER -user "admin" -password "******" -host "JDSRV07:8080" -repository "Jenasys Design Repository" "$/Jenasys/SharedComponents/JD_ReportServices_v1.0.0.0"
Processing folder: $/Jenasys/SharedComponents/JD_ReportServices_v1.0.0.0
FilesMissingCount : 0
FilesOldCount : 0
FilesEditedCount : 0
FilesRenegadeCount : 0
FilesNeedsMergeCount : 0
FilesMergedCount : 0
FilesUnknownCount : 0
FilesMoreRecentCount : 0
FilesCheckedOutCount : 0
Success

[Beth]

Vault will need to store data in a local cache. When Final Builder runs under the local account, it could be launching Vault under that same account. When the client tries to login to a repository it will look for that account's crypto information. Since Local System is not a user, it will not have this kind of data, and the login will fail. Administrator is an account that would have a local cache like any other user.

This integration was working before the upgrade, right? Was Vault and/or FinalBuilder moved? Is it possible that FinalBuilder was running under a Windows account before?

[Jamie Clayton]

Beth,

I've been running Windows 2008 + SQL Server 2005 + Vault 4.x + Final Builder 6.x + Final Builder Server 6.x all through 2009.

16th Dec 2009 upgraded server to WIndows 2008 R2 (windows 7 codebase). (upgrade not rebuild)
17th Jan 2009 migrated Vault database to SQL 2008.
17th Jan 2009 upgraded Vault server to v5.0.2
17th Jan 2009 upgraded Final Builder Server to 6.3.0.773 from the previous 6.3.0.731 release.

Rebooted the server, then when there final builder services came up, so did the crypto exceptions fire up in the VS 2008 debugger, so I had to disable the service.

[Beth]

Do you know what account Final Builder was running under before the upgrade?

Could you create a Custom account and run the Final Builder as that user?

[Jamie Clayton]

The solution to this issue was to change the permissions on the

%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\MachineKeys to allow domain\Administrator full permission.

See http://blog.devstone.com/aaron/archive/ ... /1365.aspx

I used the vault server to manually compile a VS2008 solution and got a crypto error. Google provided the answer when I provided the exception details.

[Beth]

Thanks for the update.