Unknown Error When Changing a User's Password

[sbeadle1]

📖 Home  Back  

Symptoms

When changing your own user's password or changing another user's password within ClearSCADA an 'unknown error' is returned to your client and the user's password is not changed. This may be seen on all current ViewX clients or only certain subset of ViewX clients.

Cause and Overview

ClearSCADA, to ensure the credentials are protected, will encrypt the credentials when passing the new password from the client to the server. To do this when the server is started it generates a certificate for each IP address that the server has, and this is recorded within the DBStartup log file as follows:

30-JUN-2014 03:57:46.973 137C SVR Generating private key and certificates for secure sessions...

30-JUN-2014 03:57:47.266 137C SVR  - Generated certificate for "10.0.0.12"

30-JUN-2014 03:57:47.426 137C SVR  - Generated certificate for "127.0.0.1"

30-JUN-2014 03:57:47.560 137C SVR  - Generated certificate for "192.168.126.1"

30-JUN-2014 03:57:47.694 137C SVR  - Generated certificate for "192.168.132.1"

30-JUN-2014 03:57:47.694 137C SVR ...4 certificates generated.

When a user's password is changed the relevant certificate is used to encrypt the credentials based on the IP address through which the client is connected to the ClearSCADA server, so if the IP address changes (due to a manual configuration change or DHCP) then there will be no matching certificate and the password change will fail with the unknown error message.

The same error will appear if using Windows Logon to authenticate against the ClearSCADA server from ViewX or another client as that also uses a secure session for the user's credentials.

Note that all password changes are covered by secure sessions in recent ClearSCADA versions.

Resolution

Certificates are only generated at startup and so the long-term options are:

1. Restart ClearSCADA. If running in a hot-standby or triple-standby arrangement perform changeovers to ensure the system remains online at all times if required.
2. Modify the server to have a static IP address either in the server's operating system or the DHCP server to be an IP address that a certificate was generated for. Be aware that if you are using name resolution to access the ClearSCADA servers this needs any suitable modifications to ensure clients continue to be able to access the servers

If a restart or IP address change is not possible at the moment, a temporary work around for changing passwords may be to change the password from the desktop of the server. To do this modify your client connections to connect to the local server using 127.0.0.1 (localhost) as this will always have a certificate generated. Using this connection to 127.0.0.1 you should be able to change the passwords without an issue.

Restarting ViewX will not fix this problem.

It is not recommended to change your ClearSCADA server's IP address whilst ClearSCADA is running.

Go: Home Back