We have an ASP.Net MVC application that invokes the Azure Cognitive Search API to execute a search. The application is deployed in an Azure VM running IIS. When the ACS API is invoked we are getting the following error:
System.Net.Http.HttpRequestException: An error occurred while sending the request. ---> System.Net.WebException: The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel. ---> System.Security.Authentication.AuthenticationException: The remote certificate is invalid according to the validation procedure.
at System.Net.TlsStream.EndWrite(IAsyncResult asyncResult)
at System.Net.ConnectStream.WriteHeadersCallback(IAsyncResult ar)
--- End of inner exception stack trace ---
at System.Net.HttpWebRequest.EndGetRequestStream(IAsyncResult asyncResult, TransportContext& context)
at System.Net.Http.HttpClientHandler.GetRequestStreamCallback(IAsyncResult ar)
--- End of inner exception stack trace ---
If I invoke the ACS API from an Azure developer VM in the same subnet via Postman it works fine.
Problem
It's possible you are running an old OS image or have Windows Update disabled on your VM which prevents the latest intermediate and root certificate authorities from updating.
Solution
Run Windows Update on your VM, or use the latest Azure VM OS image.
You can verify if you have the latest intermediate certificate authorities by checking the cert store on the VM. Specifically, you're looking for "Microsoft Azure TLS Issuing CA 01" which is the intermediate cert authority Azure Cognitive Search and most Azure services are using.
Manage User Certificates -> Intermediate Certification Authorities -> Certificates -> "Microsoft Azure TLS Issuing CA 01"
Related
I am getting below error in my logic app workflow, I have schedular->MQ->Azure EventHub connectors. I can see message coming till MQ and there is failure in eventhub with below error. Appreciate for any suggestion why this error is comming up, and how to overcome this.
"BadRequest. Http request failed as there is an error: 'The SSL connection could not be established, see inner exception."
You might be receiving this due to Authentication or certificate errors.
You can check for the connection you are establishing while creating the event hub connector.
Authorize access to an event hub by using a Sytem assigned managed identity.
Try checking certificate expiration - To configure service principals with certificate credentials where Azure AD can be used to build a service principal with restricted access at the resource level. Azure Key Vault may be utilised with Azure-managed identities in both scenarios, such that the runtime environment, such as an Azure function, can get the credential from the key vault.
Also you can try checking the inner exception that is occuring and take further actions accordingly.
REFERENCES:
Azure security baseline for Event Hubs
Authentication a managed identity with Azure Active Directory
PowerBI: Version: 2.86.727.0 64-bit (October 2020)
ODBC Connector: PowerBI's integrated Snowflake ODBC connector (out of the box one)
Snowflake: .southeast-2.privatelink.snowflakecomputing.com
Authentication: OAuth2.0 integration with AAD
Error Message while connecting from PowerBI:
Details: "ODBC: ERROR [HY000] [Microsoft][Snowflake] (4)
REST request for URL https://bhp_dev.ap-southeast-2.privatelink.snowflakecomputing.com:443/session/v1/login-request?requestId=6100abf5-7441-4dc8-8b86-35f44ca0e94c&request_guid=257da304-137e-4e39-95b0-edfff416fb0d&warehouse=COST_MONITOR
failed: CURLerror (curl_easy_perform() failed) - code=60 msg='SSL peer certificate or SSH remote key was not OK' osCode=9 osMsg='Bad file descriptor'
Snowflake setup:
created a security integration to enable SSO as per the doco link
created a network policy to include the PowerBI and PowerQueryEditor network addresses
assigned the network policy to a user
PowerBI setup:
nothing special.
The SSO works ok when the Snowflake is not using private links.
Any ideas would be greatly appreciated.
Currently, the Snowflake Power BI SSO feature has the following limitations:
AWS PrivateLink and Azure Private Link are not supported. If it is necessary to use either of these two services to connect to Snowflake, use the on-premises gateway to connect. This pathway will not provide single sign-on.
https://docs.snowflake.com/en/user-guide/oauth-powerbi.html#limitations
We have the infamous Kerberos double hop issue.
This is a brand new domain, being migrated from another provider where impersonation and delegation was previously working. We have upgraded OS's and to the latest SQL server (2017).
WPF app (using domain creds) -> Web Service (WCF app on IIS 10) -> SQL 2017 (named instance)
The web service is running under a domain account. The web service has an spn registered, Anonymous Auth is disabled as is forms auth, ASP.NET Impersonation and Windows Auth is enabled. Providers are "Negotiate and NTLM," "Kernal Mode" is disabled, "Use App Pool credentials" is enabled. SPN created:
HTTP/<url of web service> <AppPool Creds>
We are able to login to the web service via a browser on a remote computer, enter domain credentials and have the expected response (web page displayed). IIS Log shows domain user creds as expected.
The SQL server is a named instance, running under domain creds. SPNs created:
MSSQLSvc/<fqdn>:<Instance> <SQL Domain Creds>
MSSQLSvc/<sql server netbios>:<Instance> <SQL Domain Creds>
MSSQLSvc/<fqdn>:<port> <SQL Domain Creds>
MSSQLSvc/<sql server netbios>:<port> <SQL Domain Creds>
The IIS App Pool user account in AD is setup for constrained delegation to the SQL server for both the port and the named instance.
When logging in through software to web service (WPF calling WCF Service with no database call), a normal response is seen.
When logging in through software to web service with a database call, sql profiler shows Anonymous Logon. With Kerberos Logging enabled on IIS box, the following error is received:
Error Code: 0xd KDC_ERR_BADOPTION
Extended Error: 0xc0000225 KLIN(0)
Server Name: MSSQLSvc/<sql server fqdn>:49942
Target Name: MSSQLSvc/<sql server fqdn>:49942#<domain.com>
We also tried unconstrained delegation, but received same result.
SETSPN -X shows no duplicates.
Thank you in advance for your help!
When all else fails, and you've literally spent days and days working on the problem and reading every article on the Internet:
REBOOT
Yup. That was the fix. Rebooting the IIS server which was the server delegating the permissions, fixed the issue.
For those looking to quickly and easily setup constrained delegation between IIS and an instance of SQL, both running under custom domain creds, set your settings exactly as above and reboot.
Best wishes.
I am accessing my server through remote desktop connection and have configured a webservice in IIS. I am able to see the methods but when I click on the button to "Invoke" I get the following error:
System.Data.SqlClient.SqlException: Login failed for user 'SOLDev\Server02$'.
at ShareWare.Web.Service.WebAPI.Reservation.GetInfo()
Why is it taking the machine name as the user?
My windows authentication user is User1Dev.
Also my directory security in IIS is setup as follows:
Option "Enable anonymous access" -- it's disabled
Option "Integrated Windows Authentication" -- checked off
I am using .NET framework 2.0
Your web service connects to the SQL using Windows authentication as the principal running the service. In this case it appears to be BUILTIN\System or BUILTIN\Network Service, both of which authenticate in the domain as the machine account, ie. 'SOLDEV\Server02$' which corresponds to a machine named Server02 in the domain SOLDEV.
If you wish to authenticate on the SQL Server with your own login, then the IIS must flow the authentication information, in a process called Constrained Delegation. See Configuring Constrained Delegation for Kerberos (IIS 6.0). or How To: Use Protocol Transition and Constrained Delegation in ASP.NET 2.0.
If you want the web service to authenticate to SQL Server as itself, then you must grant login permission to the web service principal on SQL: CREATE LOGIN [SOLDEV\Server02$] FROM WINDOWS.
It's because the web service is running as the Network Service id, not as the logged in user. You probably also need to have <identity impersonate="true" /> in your web config if you are planning to use the user's credentials to connect to SQL Server.
is it possible to use a database created in a Azure VM as a data source for model which is created in Azure Analysis Services?
So far, when I specify connection properties for the model in the web designer and test connection, I get an error stating "a connection was successfully established with the server, but then an error occurred during the login process. (provider SSL Provider, error: 0 - The certificate chain was issued by an authority that is not trusted.)
I can connect to the server via SSMS and via RDP.
I created a self-signed certificate in the azure key vault and was able to make the SQL server use it. However I can't seem to find out how to make use of it when connecting the model.
Does anyone know if it's possible and if so, what should I do to make it work?
In the end I managed to make it work. For anyone with similar problem, I will write my solution below.
For the error "The certificate chain was issued by an authority that is not trusted" - just as discussed in the thread linked by TJB in comment, this was because I did not have a CA signed certificate, but a self-signed one.
A CA signed certificate from Azure would probably solve the issue, but I tried the Let's Encrypt site (also linked in the other thread). The issue I had with Let's Encrypt was that I had a windows server, while they natively support linux-based systems.
However I found an article by Daniel Hutmacher called Encrypting SQL Server connections with Let’s Encrypt certificates which was solving the very issue I had.
(as for the client tool, the current version is different from the one described in the article, but you can still download the old version on github. I used the lastest november 2017 release). With this I was able to generate and add a CA signed certificate to SQL server.
At this point, I created a model in Azure Analytics Services, used Azure Database as type of source/connection and filled in the connection to my VM SQL server. I saw my database tables, but when I tried to query data, I got a new error, stating that the AAS need an On-premise data gateway set up.
The Microsoft docs Install and configure an on-premises data gateway describes how to install on-premise data gateway on the VM, but if you are like me and use personal account for azure, you will have issues binding your account to the gateway. The solution as hinted here is to create a new account in Azure Active Directory (I created a new user and registered it under my azure custom domain, so the login looked like XXX#zzz.onmicrosoft.com). I gave the user admin role, so as to temporarily avoid any azure permission setbacks. Next I added the user to my subscription via Subscriptions -> "My_subscription" -> Access Control (IAM) and assigned an owner role to the AD user.
Now back on my VM I could bind the new user's account to the gateway (don't forget to change the gateway's region to your preferred region before finishing the setup).
Next, on Azure I created an "on-premise data gateway" service (do note you need to select same region as the one which your VM gateway is located under). I am not sure now, if only the new AD user I created could see the gateway, so in case you do not see it, try the AD user as well.
Last but not least, in the Azure Analytics services I went to the "on-premises data gateway" settings and set it to use the one I just created.
With this I was able to create the model and query the data from database.
Note:
In the model web designed for analytics services I happened to be logged in under the AD user, not under my personal account. Attempting to change the account to my personal one ended up in login failure, however after a few such attempts and opening multiple web designers in separated tabs, I correctly logged in under my personal account. After a while I could no longer replicate the issue.
I guess the issue may have been that I was logged in to Azure under both my personal account and the AD user at the same time in same browser when setting eveything up.