0

From certain domains, users are not resolving in our SharePoint environment.

event viewer logs:

An exception occurred in AD claim provider when calling SPClaimProvider.FillResolve(): Error during decryption. System error code 0

When i gone through the ULS Logs,

GetUserInfoFromMembershipProvider: Exception in SPUtility.ResolvePrincipal. WebApp: '67f5b370-a9af-4ea6-8efe-7ff42f33bff1', LoginName: 'i:0#.w|DomainName\User', bIsRole: 'False', Exception: 'System.ArgumentException: Error during decryption. System error code 0. at Microsoft.SharePoint.Administration.SPCredentialManager.DecryptWithApplicationCredentialKey(Byte[] rgbEncryptedPassphrase) at Microsoft.SharePoint.Administration.SPPeoplePickerSearchActiveDirectoryDomain.get_Password() at Microsoft.SharePoint.Utilities.SPActiveDirectoryDomain..ctor(SPPeoplePickerSearchActiveDirectoryDomain peoplePickerDomain) at Microsoft.SharePoint.Utilities.SPUserUtility.GetWindowsPrincipalResolvers(SPWebApplication webApp, Boolean includeUpnInOperations, String userAccountDirectoryPathRestriction, SPPrincipalResolver bySidResolver) at Microsoft.SharePoint.Utilities.SPUserUtility.CreatePrincipalResolvers(SPWebApplication webApp, ICollection1 urlZones, Nullable1 currentZone, SPPrincipalResolver bySidResolver, String userAccountDirectoryPathRestriction, Boolean alwaysAddWindowsResolver, Boolean includeUpnInOperations) at Microsoft.SharePoint.Utilities.SPUtility.ResolveWindowsPrincipal(SPWeb web, SPWebApplication webApp, String input, SPPrincipalType scopes, Boolean inputIsEmailOnly, Boolean includeUpnInOperations) at Microsoft.SharePoint.Administration.Claims.SPActiveDirectoryClaimProvider.ResolvePrincipalInfo(Uri context, SPPrincipalType principalType, Boolean inputIsEmailOnly, Boolean disableEmailResolve, Boolean resolveIncludesUpnProperty, String resolveInput, Boolean& resolved) at Microsoft.SharePoint.Administration.Claims.SPActiveDirectoryClaimProvider.FillResolve(Uri context, String[] entityTypes, Boolean inputIsEmailOnly, String resolveInput, List1 resolved) at Microsoft.SharePoint.Administration.Claims.SPActiveDirectoryClaimProvider.FillResolve(Uri context, String[] entityTypes, SPClaim resolveInput, List1 resolved) at Microsoft.SharePoint.Administration.Claims.SPClaimProvider.Resolve(Uri context, String[] entityTypes, SPClaim resolveInput) at Microsoft.SharePoint.Administration.Claims.SPClaimProviderOperations.Resolve(Uri context, SPClaimProviderOperationOptions mode, String[] providerNames, String[] entityTypes, SPClaim resolveInput) at Microsoft.SharePoint.Utilities.SPUtility.ResolvePrincipalClaims(SPWeb web, SPWebApplication webApplication, Nullable1 urlZone, String input, SPPrincipalType scopes, SPPrincipalSource sources, SPPrincipalInfo user, Boolean inputIsEmailOnly) at Microsoft.SharePoint.Utilities.SPUtility.ResolvePrincipalInternal(SPWeb web, SPWebApplication webApp, Nullable1 urlZone, String input, SPPrincipalType scopes, SPPrincipalSource sources, SPUserCollection usersContainer, Boolean inputIsEmailOnly, Boolean alwaysAddWindowsResolver) at Microsoft.SharePoint.Utilities.SPUtility.ResolvePrincipal(SPWebApplication webApp, Nullable`1 urlZone, String input, SPPrincipalType scopes, SPPrincipalSource sources, Boolean inputIsEmailOnly) at Microsoft.SharePoint.SPManagedCodeInterop.GetUserInfoFromMembershipProvider(Guid siteId, String loginName, Boolean bIsRole, Boolean& userExists, String& email, String& title, String& userKey, String& mobilePhone, Boolean& isShareByEmailGuestUser)'.

Improve this question

2 Answers 2

Reset to default
1

Unless these domains are one-way trusts, you can remove the username and password from the PeoplePickerSettings for that particular domain.

With that said, you must set the application credential key on each server in the farm to the same value. The stsadm command for setting the setapppassword parameter only sets the value on that particular server.

Lastly, verify on the registry key HKLM\SOFTWARE\Microsoft\Shared Tools\Web Server Extensions\15.0\Secure that WSS_WPG has Read rights and WSS_ADMIN_WPG has Full Control on each SharePoint server.

Improve this answer
5
  • These are one way trust domains, can i still remove the username and password?
    – Achiever SP
    Commented Aug 17, 2018 at 16:39
  • No, if you have a one-way trust you need the username and password. At this point, it just sounds like you need to set the app cred key on each farm member (I do not recall if you need to reset your PeoplePickerSettings after doing so -- I'd assume so since you're establishing a new encryption key).
    – user6024
    Commented Aug 17, 2018 at 16:55
  • Ok, can you kindly share any articles to understand the literature behind and sequence of commands to be executed?
    – Achiever SP
    Commented Aug 17, 2018 at 17:21
  • 1) $wa = Get-SPWebApplication spwebapp1 $wa.PeoplePickerSettings.ActiveDirectoryCustomFilter = $null $wa.Update() 2) stsadm.exe -o setapppassword -password pwd12345 3) stsadm -o setproperty -pn peoplepicker-searchadcustomfilter -pv "domain:adforest" -url "constso.com" 4) IISRESET Will the above sequence of steps work?
    – Achiever SP
    Commented Aug 17, 2018 at 18:08
  • i performed it, but the issue still exists. Post executing those commands, i did IIS reset, config cache clear and rebooted my server. Wondering is there any possibility that the old password is cache some where? Interestingly post executing those commands, i am not seeing any errors in my event viewer or ULS logs, but user is still not resolving.
    – Achiever SP
    Commented Aug 29, 2018 at 15:26
0

I will leave this here as it took me some time to verify what was wrong.

I have a people picker that should take users from 2 domain. Followed all the steps from great article.

I've tried already all the troubleshooting from here without success.

Still error Sorry, we’re having trouble reaching the server.

What I found that before you setup the PeoplePickerSettings.SearchActiveDirectoryDomains you have to run the command:

STSADM.exe -o setapppassword -password key

And then also Alberto suggested adding to PeoplePickerSettings.SearchActiveDirectoryDomains should be run on each server on the farm!

Finally all works as expected

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.