ProGet encryption key decryption failure

sneh.patel_0294

Hello,

We currently use Windows servers for our ProGet cluster. We tried to add another node to our cluster by installing ProGet on it and copying the same configurations as the other nodes (i.e. DB connection string, encryption key, etc). However, when we did that we noticed that the new node had the following error:

This resulted in instability for our ProGet app (many 403 errors and clicking buttons would result in the login page). We have disabled the node for now. What could the issue be? We have checked everything including the ProGet.config files and they are the same across all nodes. We also checked the permissions for those files and they are also consistent.

stevedennis

Hi @sneh-patel_0294 ,

This message means that the decryption keys across machines are different, which result in exactly the behavior you describe (403s, logouts):
https://docs.inedo.com/docs/installation/configuration-files

I know you mentioned you already checked, so there's likely a typo, miscopy, looking at the wrong folder, etc. Note that the folder is %PROGRAMDATA%\Inedo\SharedConfig\ProGet.config, as opposed to C:\ProgramData\Inedo\... - on some machines, the program data folder is stored in a different location.

I would also make sure to restart the service/web as well. To test, you can try loading that tpage on all nodes and you should not see "Encryption key decryption failure" when refreshing the nodes.

Hope that helps,
Steve

sneh.patel_0294

"I would also make sure to restart the service/web as well. To test, you can try loading that tpage on all nodes and you should not see "Encryption key decryption failure" when refreshing the nodes."

Hi, thank you for your response. How do you do the above?

stevedennis

@sneh-patel_0294 to restart the services, you can do so from the Inedo Hub or the Windows Services (look for INEDOPROGETSVC and INEDOPROGETWEBSVC). If you're still using IIS, make sure to restart the app pool as well

sneh.patel_0294

Sorry, I meant for "To test, you can try loading that tpage on all nodes and you should not see "Encryption key decryption failure" when refreshing the nodes."

How do you do this?

stevedennis

Hi @sneh-patel_0294 ,

What I mean is, in your browser, open multiple tabs -- one for /administration/cluster on each node in the cluster, bypassing the load balancer. All nodes should show "green" for that.

The one that shows "red" still has the wrong encryption key. Modify the encryption key, and restart the servicies, and reload the tab, and it should work fine.

Thanks,
Steve

sneh.patel_0294

Thanks! I think the restart of IIS App Pool might have helped. I don't see that failure anymore.