UserManagementService issue

[jrjespersen]

I'm having an issue with the User Management service. On one server, the calls from our custom app to the User Management service succeed. However, when our custom app calls any of our other servers, the web service calls fail (return a null in the response with a status code of HTTP 200). Nothing related shows in the Checkbox exception log.

I'm calling the web service with the following code. I know the values I'm submitting are correct, because I can navigate to the URL and I can login the normal login form with the username and password.

Code snippet:
UserManagementServiceProxy WebServiceProxy = new UserManagementServiceProxy();
WebServiceProxy.Url = URLTextbox.Text;
Nullable<Guid> UserToken = WebServiceProxy.AuthenticateUser(UserIDTextbox.Tex t, PasswordTextbox.Text);

With this snippet, if I point to any server but my dev server, UserToken is always null. Any suggestions for finding the cause of this problem?

Thanks,
Jonathan

[pwiesner]

Have you confirmed that the user management web services are installed on the servers you are unable to connect to? You should not see a login prompt if you connect to the web service; you should see a list of available methods.

[jrjespersen]

Yes. I can browse to the User Management service and all available methods on each server. I've also done a filesystem compare between the servers, and the only differences other than timestamp are web.config (use different database and app URL) and license files.

The User Management Service returns an HTTP 200. In fact, this is the response body that comes back from the service on the servers that fail to authenticate:

<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
	<soap:Body>
		<AuthenticateUserResponse xmlns="http://prezzatech.com/Checkbox/Services">
			<AuthenticateUserResult xsi:nil="true" />
		</AuthenticateUserResponse>
	</soap:Body>
</soap:Envelope>

Even though the call completes and a nil is returned, there's no evidence that I can find of an exception being thrown. I am stumped at what I missed to cause this difference in behavior.

[jrjespersen]

I should add that I'm using version 4.4.0.5.

[jrjespersen]

I just discovered more to this issue. I confirmed this morning that it is related to password encryption.

I ran my sample code against the working dev box to confirm it still worked. I then changed the admin password and confirmed that it still worked. I then enabled password encryption, and the web service proxy returned a null object.

I read something in the docs yesterday about using encryption and calling the web service. I will try to find that and reference it in this thread as well.

In the meantime, any ideas of fixing this issue (or it being fixed in a newer version)?

Thanks,
Jonathan

[jrjespersen]

Originally Posted by jrjespersen

I read something in the docs yesterday about using encryption and calling the web service. I will try to find that and reference it in this thread as well.

I found the reference in the doc, but it's not directly related. In UserManagementAPI.pdf on page 22 (in the section Authenticating users), the second example has this text in the description:

Authenticate a non-network user based on the provided user name and password. When password encryption is
enabled, the UserManager will hash the password before comparing it against the password stored in the database.

However, the example shows using the UserManager object directly through the API, not through the web service. But in my situation, does the User Management web service use the UserManager object in a way that this statement should apply to it?

[pwiesner]

Thank you for the additional information. You are correct the issue appears to be the caused by enabling password encryption. I am going to continue to look into the issue and will respond when I have a better understanding of what is going wrong.

[jrjespersen]

Thanks!

In the meantime, I've downloaded 4.4.1 and will see if I can duplicate in that version. If 4.4.1 works correctly, it will be an option for us to immediately upgrade to fix this issue. Encrypted passwords are a requirement for our implementation.

[pwiesner]

I have not tested in the 4.4.1 build yet; however, I was able to reproduce the issue using the current development build which means it is likely an issue in 4.4.1 as well.

[pwiesner]

I believe we have found the source of the problem and corrected it. Please contact the support team so that they can send you a custom build of the web services dll.