• Replies 2 replies
  • Subscribers 139 subscribers
  • Views 1206 views
  • Users 0 members are here
Options
Related

IshRemote authentication error from Windows server

Barra Sweeney

We are unable to authenticate to Tridion from a particular Windows 2016 Standard edition server. We can authenticate from other servers and from regular desktops using the same command and accounts/credentials.

We get this error message

New-IshSession : The communication object, System.ServiceModel.Channels.ServiceChannel, cannot be used for communication because it is in the Faulted state.

I've seen the faulted state error previously where invalid credentials are used but this is not the case here, the credentials are valid. And we get the same error when connecting to both ADFS and  ISHSTS Tridion servers, e.g using either

$ishSession = New-IshSession -wsBaseUrl https://adfs-server

OR

$ishSession = New-IshSession -wsBaseUrl https://ishsts-server -IshUserName username -IshPassword password

The Powershell version (5.1.14393.3053) and IshRemote version (0.9) are the same on this server as on a working server.

What can we look at to determine why the authenticate is not working from this server? We've rebooted the server to no avail. The server is running Jenkins but stopping the Jenkins service doesn't help. Also, we can log in to Tridion from that server using the web client.

thanks,

Barra
Rate translation
×
Suggest better translation
×
Parents Reply
  • in reply to Barra Sweeney

    Much appreciated on closing the loop on this one...

    The somewhat generic error message comes from the underlying implementation of the WS-Trust protocol, as authentication and in turn tokens are very time sensitive (like in expiring); you can also imagine that the actual log on is an issue.

    So most likely in your scenario the underlying protocol makes a log on request that gets an answer from your server which is wrong in the timeline (let's say the past). There is a skew time or grace period for two systems to be off regarding exact time, but if way too much off this is seen as replay-attacks or attempts to hack the system.

    Don't know if the above would make a better exception message... but it is Friday evening for me :-)
Children
No Data