Microsoft KB Archive/912769

= FIX: Error message in the Single Sign-On Migration utility when you try to import data from a Host Account Cache database to an Enterprise Single Sign-On database: “Invalid password or key file” =

Article ID: 912769

Article Last Modified on 12/4/2007

-

APPLIES TO


 * Microsoft Host Integration Server 2004 Standard Edition

-





SYMPTOMS
When you use the Single Sign-On (SSO) Migration utility (Hisssomig.exe) in Microsoft Host Integration Server 2004 to import data from a Host Account Cache database to an Enterprise Single Sign-On (SSO) database, you may receive the following error message:

Invalid password or key file

Additionally, information that is similar to the following may be logged in the log file that the SSO Migration utility creates:


 * Log started on

[ Info] Validating the file integrity

[ Info] The validation succeeded

[ Info] Decrypting the passwords

[ Error] An error has occured while decrypting passwords (Invalid password or key file.

[ Error] The import failed (Invalid password or key file)


 * Log closed on

Note In the log entry, &quot;occured&quot; is a misspelling of the word &quot;occurred.&quot;

This problem occurs when the following conditions are true:
 * You are importing data that was exported from a Host Account Cache database.
 * The SSO Migration utility is running on a Microsoft Windows Server 2003-based computer.
 * You are exporting and importing data from a Host Account Cache database that is located on a Microsoft Windows 2000 Server-based computer.

Note This problem does not occur when the computer on which the SSO Migration utility is running and the computer where the Host Account Cache database is located are running the same version of the Microsoft Windows operating system.



CAUSE
The SSO Migration utility and the Udbkey.exe utility were designed to use the default Cryptographic Service Provider (CSP) of the operating system on which these utilities are installed. The problem occurs because the default CSP on Windows Server 2003 differs from the default CSP on Windows 2000 Server. Therefore, the SSO Migration utility that is running on a Windows Server 2003-based computer cannot decrypt data from a Host Account Cache database that is located on a Windows 2000 Server-based computer.



Hotfix information
A supported hotfix is now available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing this specific problem. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next service pack that contains this hotfix.

To resolve this problem, submit a request to Microsoft Online Customer Services to obtain the hotfix. To submit an online request to obtain the hotfix, visit the following Microsoft Web site:

http://go.microsoft.com/?linkid=6294451

Note If additional issues occur or any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. To create a separate service request, visit the following Microsoft Web site:

http://support.microsoft.com/contactus/?ws=support

File information
The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.

Note Because of file dependencies, the most recent hotfix that contains these files may contain additional files.



STATUS
Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the &quot;Applies to&quot; section.



MORE INFORMATION
The Host Integration Server 2004 SSO migration utility is described in the Host Integration Server 2004 documentation under the topic &quot;Upgrading from Host Integration Server 2000 or SNA Server 4.0.&quot; To view this topic, type Upgrading from Host Integration Server 2000 in the documentation Search box.

Note To view this topic online, visit the following Microsoft Developer Network (MDSN) Web site:

http://msdn2.microsoft.com/en-us/library/ms964346.aspx

The documentation explains the steps to perform the migration. However, some items are not clearly explained and may cause problems during the migration. The following information outlines the steps that are required to perform the migration from a Host Account Cache database to an Enterprise SSO database:  Install Enterprise SSO on the system that will operate as the Master Secret Server (MSS). For more information, see the &quot;Security User’s Guide&quot; topic in the Host Integration Server 2004 Documentation. Copy the updated Hisssomig.exe file to the Enterprise SSO Master Secret Server. Copy the Scrypt.dll file from the Support\Utilities\ folder on the Host Integration Server 2004 image to the same location as the Hisssomig.exe file on the Enterprise SSO Master Secret Server.

Note If the Scrypt.dll file is not in the same location as the Hisssomig.exe file, an error message that is similar to the following is logged in the migration log file when you try to import the exported data:

[ Error] The import failed (The type initializer for &quot;Microsoft.SSO.Migration.DecryptionHandler&quot; threw an exception.)

 Copy the updated Udbkey.exe file to the primary domain controller (PDC) Emulator that hosts the master Host Account Cache database. At a command prompt, locate the folder that contains the Udbkey.exe utility.</li> Run the following command to export the encryption key that the Host Account Cache database uses:

udbkey -output  -password  

Note If you run the udbkey command without parameters, the expected syntax for the command is displayed.</li> Copy the encryption key file that the Udbkey.exe utility created in step 6 to the Enterprise SSO Master Secret Server. Copy this file to the same location as the Hisssomig.exe file and the Scrypt.dll file.</li> Export the data from the Host Account Cache database. To do this, run the following command:

hisssomig -export -server  -output  

Note Replace servername with the name of the server that is hosting the master Host Account Cache database. Replace XML file name with the name of the file to which you want the exported data written.

Note If you run the hisssomig command without parameters, the expected syntax for the command is displayed.</li> Import the data into the Enterprise SSO database. To do this, run the following command:

hisssomig -import -input  -key   -password  

Note Replace XML file name with the name of the file to which the exported data was written in step 8. Replace filename with the name of the encryption key file that the Udbkey.exe utility created in step 6. Replace password with the password that you used in step 6.</li></ol>

<div class="references_section">