Error: "Unable to invoke requested method on given webservice. Failed to verify signature on xml blob."

Products

• Client Management Suite
• IT Management Suite
• Server Management Suite

Issue/Introduction

PPA debug logs show the error:

1074.32702637 [11464] PPA: Resolving credential:
1074.32702637 [11464] PPA: Credential: <Value>
1074.32727051 [11464] InitializationParams::InitializationParams() - Setting Cache Time out to default value of 300 seconds
1074.32751465 [11464] InitializationParams::InitializationParams() - Setting Cache Time out to default value of 300 seconds
1074.32763672 [11464] CredentialService::GetCredentials: Going to fetch credential from server - {<VALUE>}
1074.36486816 [11464] PPA: Failed to resolve credentials from Credential Manager for: '<VALUE> with Inner exception:
1074.36499023 [11464] PPA: Unable to invoke requested method on given webservice. Error- Failed to verify signature on xml blob
1074.36511230 [11464] PPA: CP::FromXml:> failed to fetch credentials for protocol {<VALUE>}
1074.36523438 [11464] PPA: Failed to resolve credentials from Credential Manager for: '<VALUE>'
1074.36523438 [11464] PPA: CP::FromXml
1074.36523438 [11464] ConnectionProfile::ResolveRuntimeCredentials()
1074.36523438 [11464] Failed to resolve credentials from Credential Manager for: '<Value>'
1074.39184570 [11464] PPA: Unable to fetch any credential referenced in CP XML
1074.39208984 [11464] PPA: ProfileManager::GetConnectionProfile: Throwing exception

Environment

ITMS 8.x

Cause

Mismatch of Credential Manager Public Keys between the SMP Server and the Symantec_CMDB database.

Resolution

Step 1: Check if the Symantec management agent is properly installed and can connect with the server without any issues. Do a send inventory and check logs for any communication error. Check if the Symantec Management agent is communicating with the server using HTTPS or HTTP.

Step 2: Check if Credential Manager WCF services are working properly  -

• Type the following URLs into the web browser if NS and Altiris Agent are set to communicate in non-SSL mode :

http://localhost/Altiris/CredentialManager/Service/CredentialManagerRegisterWebService.svc
http://localhost/Altiris/CredentialManager/Service/CredentialManagerServicesWebService.svc

• Type the following URLs into web browser if NS and Altiris Agent is set to communicate in ssl mode :

https://localhost/Altiris/CredentialManager/Service/CredentialManagerRegisterWebServiceSecure.svc
https://localhost/Altiris/CredentialManager/Service/CredentialManagerServicesWebServiceSecure.svc

NOTE:  When typing the URL on the browser you must see a page saying: This is a Windows© Communication Foundation service.

 Step 3 : If  Symantec Management agent is working properly along with WCF services perform the below mentioned steps -

• Perform a full backup of the SMP Server and Symantec_CMDB database.
• Remove all rows from CMClientPublicKey.
• Delete registry key HKLM\Software\Altiris\CredentialManager
• Uninstall existing Symantec management agent and re-install it. (OPTIONAL)
• After installation wait for Altiris agent to get “computer Id”. [ Check it in Symantec Management Agent > Settings dialog ]. (OPTIONAL)
• Once you see “computer id” being present re-run CMClientInstall.exe from NSCap\Bin\x64\CredentialManager as Administrator. Check whether ServerURL,Exchange, Signature values are created under registry hive  HKLM\Software\Altiris\CredentialManager\Keys\{GUID.EN_US}.
• Do a reboot of the SMP Server.
• Re-launch the browser and Symantec management console to check whether existing and new Connection profiles and credentials are working.