Devart Forums

Thanks for the fix.

Thanks.

Just to update the topic since it is one way for us to track the status of an issue, I received an email from Devart stating that the issue has been reproduced.

Requires: Windows 7 (or 2008) with IIS 7.5 (not IIS 7)
Devart version: 6.30.160.0

Steps to Reproduce:
1. Create an ASP.Net web application (or web service) that is configured to connect to MySQL database using database SSL
2. Add two virtual applications on IIS 7.5 to run on separate app pools (AppPoolA and AppPoolB) using the application created in Step 1.
3. Configure the app pools to run as "Network Service" instead of "ApplicationPoolId" identity.
4. Make a request to a page in the web application that connects to the database that is part of AppPoolA. (This step should succeed).
5. Make a request to a page in the web application that connects to the database that is part of AppPoolB. (This step fails with "2026: Could not read client key error" or "Couldn't acquire crypto service provider context").

Reason:
Under "C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys" folder, the key container file created does not add "Network Service" to the ACL. Instead it adds only "AppPoolA" to the list and the "AppPoolB" has no access on it.

The ACL should be on the SID of the account that the app pool is configured for. In this case, the "Network Service" account.

Note that this problem does not appear when the app pools are configured to use "ApplicationPoolId" and in that case two key container files are created, one for each app group.

Please advise.

Shalex,

Thanks for the update. We are aware of the workaround but since we do not manage installations for our customers, it becomes support burden for us.

We are discussing whether we want to introduce a new version of the drivers this late in the release cycle. In any case, please update once you have the new version so that we can at least start testing it.

Thanks. We are waiting for a quick response.

How is the key generated that is used to encrypt the data in SSL mode? Are you using some predefined hard coded key?

We need this issue resolved asap as we are really closed to you release date.

It is the same issue. The web process (running as "Network Service") has no access on the file "9662578eb35f925aaa97e4941ca3d838_0d9c1178-8c0b-4510-8b36-8b990674bf28" in "C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys" when the file is not created by the web process.

On a fresh machine, if the component that runs as a windows service starts before the web service, the file is created by the windows service instead of the web service with limited permissions and the web process fails to read it.

All you need is SSL enabled (no client certs, no ca certs) to reproduce this problem.

Please update as soon as possible.

Correct version of the assemblies are getting loaded:

Loaded Assembly from GAC: "Devart.Data.MySql, Version=6.0.58.0, Culture=neutral, PublicKeyToken=09af7300eec23701". Location: C:\Windows\assembly\GAC_MSIL\Devart.Data.MySql\6.0.58.0__09af7300eec23701\Devart.Data.MySql.dll

Loaded Assembly from GAC: "Devart.Data, Version=5.0.159.0, Culture=neutral, PublicKeyToken=09af7300eec23701". Location: C:\Windows\assembly\GAC_MSIL\Devart.Data\5.0.159.0__09af7300eec23701\Devart.Data.dll

We did more testing here. The problem shows up on Windows 2008 Standard 64bit and 32bit, Windows XP OS (possibly other operating systems) even without client SSL requirements.

Just enable SSL and the web process will run into problems, if you start a windows service that connects to the database before the web process.

I must insist that this is very important for us to get this thing resolved as soon as possible on Windows 2003, XP, Windows7 and 2008. 32 bit and 64 bit.

Please let me know what else you require from us. Thanks.

Here is the stack trace:

[CryptographicException: Couldn't acquire crypto service provider context.]
Devart.Security.SSL.f.a(IAsyncResult A_0) +203
Devart.Security.SSL.f.a(Byte[] A_0, Int32 A_1, Int32 A_2, SocketFlags A_3)
+67
Devart.Security.SSL.y.a(Byte[] A_0, Int32 A_1, Int32 A_2) +21
Devart.Common.ak.a(Byte[] A_0, Int32 A_1, Int32 A_2) +49
Devart.Common.s.d(Byte[] A_0, Int32 A_1, Int32 A_2) +60

[MySqlException (0x80004005): Can't connect to MySQL server on 'tp78' (10061):
Authentication failed.]
Devart.Data.MySql.v.a(String A_0, String A_1, String A_2, String A_3, Int32
A_4, String A_5, Int32 A_6, SshOptions A_7, SslOptions A_8, ProxyOptions A_9,
MySqlHttpOptions A_10, HttpOptions A_11) +3694
Devart.Data.MySql.MySqlInternalConnection.Connect(MySqlConnection owner,
String userId, String password, String host, String database, Int32 port, Int32
connectionTimeout, MySqlProtocol protocol, Boolean compress, Boolean
clientInteractive) +650
Devart.Data.MySql.MySqlInternalConnection..ctor(p connectionOptions,
MySqlConnection owner) +113
Devart.Data.MySql.as.a(u A_0, Object A_1, DbConnectionBase A_2) +68
Devart.Common.DbConnectionFactory.a(DbConnectionPool A_0, u A_1,
DbConnectionBase A_2) +88
Devart.Common.DbConnectionPoolGroup.a(DbConnectionPool A_0, DbConnectionBase
A_1) +22
Devart.Common.DbConnectionPool.a(DbConnectionBase A_0) +45
Devart.Common.DbConnectionPool.GetObject(DbConnectionBase owningConnection)
+530
Devart.Common.DbConnectionFactory.a(DbConnectionBase A_0) +202
Devart.Common.DbConnectionClosed.Open(DbConnectionBase outerConnection) +138
Devart.Common.DbConnectionBase.Open() +149
Devart.Data.MySql.MySqlConnection.Open() +209

1. Exception Details

Couldn't acquire crypto service provider context.
Description: An unhandled exception occurred during the execution of the
current web request. Please review the stack trace for more information about
the error and where it originated in the code.

Exception Details: System.Security.Cryptography.CryptographicException:
Couldn't acquire crypto service provider context.

Source Error:

An unhandled exception was generated during the execution of the current web
request. Information regarding the origin and location of the exception can be
identified using the exception stack trace below.

Stack Trace:


[CryptographicException: Couldn't acquire crypto service provider context.]
Devart.Security.SSL.f.a(IAsyncResult A_0) +203
Devart.Security.SSL.f.a(Byte[] A_0, Int32 A_1, Int32 A_2, SocketFlags A_3)
+67
Devart.Security.SSL.y.a(Byte[] A_0, Int32 A_1, Int32 A_2) +21
Devart.Common.ak.a(Byte[] A_0, Int32 A_1, Int32 A_2) +49
Devart.Common.s.d(Byte[] A_0, Int32 A_1, Int32 A_2) +60

[MySqlException (0x80004005): Can't connect to MySQL server on 'localhost'
(10061): Authentication failed.]
Devart.Data.MySql.v.a(String A_0, String A_1, String A_2, String A_3, Int32
A_4, String A_5, Int32 A_6, SshOptions A_7, SslOptions A_8, ProxyOptions A_9,
MySqlHttpOptions A_10, HttpOptions A_11) +3694
Devart.Data.MySql.MySqlInternalConnection.Connect(MySqlConnection owner,
String userId, String password, String host, String database, Int32 port, Int32
connectionTimeout, MySqlProtocol protocol, Boolean compress, Boolean
clientInteractive) +650
Devart.Data.MySql.MySqlInternalConnection..ctor(p connectionOptions,
MySqlConnection owner) +113
Devart.Data.MySql.as.a(u A_0, Object A_1, DbConnectionBase A_2) +68
Devart.Common.DbConnectionFactory.a(DbConnectionPool A_0, u A_1,
DbConnectionBase A_2) +88
Devart.Common.DbConnectionPoolGroup.a(DbConnectionPool A_0, DbConnectionBase
A_1) +22
Devart.Common.DbConnectionPool.a(DbConnectionBase A_0) +45
Devart.Common.DbConnectionPool.GetObject(DbConnectionBase owningConnection)
+523
Devart.Common.DbConnectionFactory.a(DbConnectionBase A_0) +202
Devart.Common.DbConnectionClosed.Open(DbConnectionBase outerConnection) +138
Devart.Common.DbConnectionBase.Open() +149


2. Devart.Data.MySql version: 6.0.58.0

3. It is a dual core, 4GB RAM Windows 2008 64 bit machine. We saw the problem on Windows 7 Pro 64 bit machine as well.

4. IIS 7.0 (and IIS 7.5), ASP.Net 3.5

Thanks for getting us the upgraded version of the drivers.

Unfortunately, the problem still appears on Windows 7/2008 when the database requires X509. We are unable to connect to the database from the web process if the windows services start first thus creating the original problem with file permissions. Any suggestions?

Hi Shalex,

I sent an email two days ago with our license information and have not received a response. We need to get this version as soon as we can so that we can at least start testing it. Thanks for your help so far!

Thanks for the information but for some reason the only choice that I see for download is for version 5.80.190 when I login to secure.devart.com

Thanks. We should be able to wait for about a week to upgrade to the latest 6.0 version.