The SET-DB-CLIENT function returns error 16385 when using the OEREALM authentication with PASOE and the sealClientPrincipal property in the oeablSecurity-form-oerealm.xml security template is false.

Nov 21, 2020
Knowledge

Title

URL Name

The-SET-DB-CLIENT-function-returns-error-16385-when-using-the-OEREALM-authentication-with-PASOE-and-the-sealClientPrincipal-property-in-the-oeablSecurity-form-oerealm-xml-security-template-is-false

Article Number

000197245

Environment

Product: OpenEdge Version: 11.6 OS: All supported platforms

Question/Problem Description

The SET-DB-CLIENT function returns error 16385 when using the OEREALM authentication with PASOE and the sealClientPrincipal property in the oeablSecurity-form-oerealm.xml security template is false.

Steps to Reproduce

Clarifying Information

The oeablSecurity-form-oerealm.xml security template contains the following properties:

In the OEREalmAuthProvider bean:

createCPAuthn = true
sealClientPrincipal = false

In the OEClientPrincipalFilter bean:

enablecp = true

The "key" property which represents the OpenEdge domain's access code to seal the Client-Principal is also defined in the OEREalmAuthProvider bean, but not in the OEClientPrincipalFilter bean.

Error Message

CLIENT-PRINCIPAL validation failed in <db name> because - The client-principal was corrupt (16385) Failed to set security user id. (13691) Error setting client principal (12710)

Defect Number

Enhancement Number

Cause

The OEClientPrincipalFilter bean is responsible for sealing the Client Principal when the sealClientPrincipal property in the OEREalmAuthProvider bean is false, but the domain access code has not been specified in the OEClientPrincipalFilter bean. This causes a mismatch between the OpenEdge domain access code which is stored in the oeablSecurity-form-oerealm.xml security template and the domain access code stored in the database.

Resolution

Within the oeablSecurity-form-oerealm.xml security template, go to the "<b:bean id="OEClientPrincipalFilter" section and add the following property:

<b:property name="key" value="oech1::xxxxxxxxxxxx" />

The value of the key property contains the encoded domain access code which can be generated by using the command "genpassword -password <domain access code>" then prefix the output with oech1:: .

Workaround

Notes

Progress Article(s):
The ClientContextId property or SESSION-ID attribute is 0 when an OpenEdge REST web application is configured with the *-form-oerealm.xml security template

Keyword Phrase

Last Modified Date

1/5/2021 4:55 PM

The SET-DB-CLIENT function returns error 16385 when using the OEREALM authentication with PASOE and the sealClientPrincipal property in the oeablSecurity-form-oerealm.xml security template is false.

Files(0)

Was this article helpful?

Was this article helpful?

The SET-DB-CLIENT function returns error 16385 when using the OEREALM authentication with PASOE and the sealClientPrincipal property in the oeablSecurity-form-oerealm.xml security template is false.

Information

Related Articles