0

From certain domains, users are not resolving in our SharePoint environment.

event viewer logs:

An exception occurred in AD claim provider when calling SPClaimProvider.FillResolve(): Error during decryption. System error code 0

When i gone through the ULS Logs,

GetUserInfoFromMembershipProvider: Exception in SPUtility.ResolvePrincipal. WebApp: '67f5b370-a9af-4ea6-8efe-7ff42f33bff1', LoginName: 'i:0#.w|DomainName\User', bIsRole: 'False', Exception: 'System.ArgumentException: Error during decryption. System error code 0. at Microsoft.SharePoint.Administration.SPCredentialManager.DecryptWithApplicationCredentialKey(Byte[] rgbEncryptedPassphrase) at Microsoft.SharePoint.Administration.SPPeoplePickerSearchActiveDirectoryDomain.get_Password() at Microsoft.SharePoint.Utilities.SPActiveDirectoryDomain..ctor(SPPeoplePickerSearchActiveDirectoryDomain peoplePickerDomain) at Microsoft.SharePoint.Utilities.SPUserUtility.GetWindowsPrincipalResolvers(SPWebApplication webApp, Boolean includeUpnInOperations, String userAccountDirectoryPathRestriction, SPPrincipalResolver bySidResolver) at Microsoft.SharePoint.Utilities.SPUserUtility.CreatePrincipalResolvers(SPWebApplication webApp, ICollection1 urlZones, Nullable1 currentZone, SPPrincipalResolver bySidResolver, String userAccountDirectoryPathRestriction, Boolean alwaysAddWindowsResolver, Boolean includeUpnInOperations) at Microsoft.SharePoint.Utilities.SPUtility.ResolveWindowsPrincipal(SPWeb web, SPWebApplication webApp, String input, SPPrincipalType scopes, Boolean inputIsEmailOnly, Boolean includeUpnInOperations) at Microsoft.SharePoint.Administration.Claims.SPActiveDirectoryClaimProvider.ResolvePrincipalInfo(Uri context, SPPrincipalType principalType, Boolean inputIsEmailOnly, Boolean disableEmailResolve, Boolean resolveIncludesUpnProperty, String resolveInput, Boolean& resolved) at Microsoft.SharePoint.Administration.Claims.SPActiveDirectoryClaimProvider.FillResolve(Uri context, String[] entityTypes, Boolean inputIsEmailOnly, String resolveInput, List1 resolved) at Microsoft.SharePoint.Administration.Claims.SPActiveDirectoryClaimProvider.FillResolve(Uri context, String[] entityTypes, SPClaim resolveInput, List1 resolved) at Microsoft.SharePoint.Administration.Claims.SPClaimProvider.Resolve(Uri context, String[] entityTypes, SPClaim resolveInput) at Microsoft.SharePoint.Administration.Claims.SPClaimProviderOperations.Resolve(Uri context, SPClaimProviderOperationOptions mode, String[] providerNames, String[] entityTypes, SPClaim resolveInput) at Microsoft.SharePoint.Utilities.SPUtility.ResolvePrincipalClaims(SPWeb web, SPWebApplication webApplication, Nullable1 urlZone, String input, SPPrincipalType scopes, SPPrincipalSource sources, SPPrincipalInfo user, Boolean inputIsEmailOnly) at Microsoft.SharePoint.Utilities.SPUtility.ResolvePrincipalInternal(SPWeb web, SPWebApplication webApp, Nullable1 urlZone, String input, SPPrincipalType scopes, SPPrincipalSource sources, SPUserCollection usersContainer, Boolean inputIsEmailOnly, Boolean alwaysAddWindowsResolver) at Microsoft.SharePoint.Utilities.SPUtility.ResolvePrincipal(SPWebApplication webApp, Nullable`1 urlZone, String input, SPPrincipalType scopes, SPPrincipalSource sources, Boolean inputIsEmailOnly) at Microsoft.SharePoint.SPManagedCodeInterop.GetUserInfoFromMembershipProvider(Guid siteId, String loginName, Boolean bIsRole, Boolean& userExists, String& email, String& title, String& userKey, String& mobilePhone, Boolean& isShareByEmailGuestUser)'.

1

Unless these domains are one-way trusts, you can remove the username and password from the PeoplePickerSettings for that particular domain.

With that said, you must set the application credential key on each server in the farm to the same value. The stsadm command for setting the setapppassword parameter only sets the value on that particular server.

Lastly, verify on the registry key HKLM\SOFTWARE\Microsoft\Shared Tools\Web Server Extensions\15.0\Secure that WSS_WPG has Read rights and WSS_ADMIN_WPG has Full Control on each SharePoint server.

  • These are one way trust domains, can i still remove the username and password? – Achiever SP Aug 17 '18 at 16:39
  • No, if you have a one-way trust you need the username and password. At this point, it just sounds like you need to set the app cred key on each farm member (I do not recall if you need to reset your PeoplePickerSettings after doing so -- I'd assume so since you're establishing a new encryption key). – Trevor Seward Aug 17 '18 at 16:55
  • Ok, can you kindly share any articles to understand the literature behind and sequence of commands to be executed? – Achiever SP Aug 17 '18 at 17:21
  • 1) $wa = Get-SPWebApplication spwebapp1 $wa.PeoplePickerSettings.ActiveDirectoryCustomFilter = $null $wa.Update() 2) stsadm.exe -o setapppassword -password pwd12345 3) stsadm -o setproperty -pn peoplepicker-searchadcustomfilter -pv "domain:adforest" -url "constso.com" 4) IISRESET Will the above sequence of steps work? – Achiever SP Aug 17 '18 at 18:08
  • i performed it, but the issue still exists. Post executing those commands, i did IIS reset, config cache clear and rebooted my server. Wondering is there any possibility that the old password is cache some where? Interestingly post executing those commands, i am not seeing any errors in my event viewer or ULS logs, but user is still not resolving. – Achiever SP Aug 29 '18 at 15:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.