Login problem while using "NavUserPaswword" in NAV2013 clien

RV_18

Dear members,

I am facing an issue while connecting a client machine with the Nav Server through NavUserPassword ](*,) . Error message I am getting is shown below. But if I login to Nav client from server machine thru same credential type, then everything is running fine. Please suggest how this problem can be resolved or root cause of this:-

ERROR -
"The Service Principal Name (Delegation) has been set incorrectly. Server connect URL: "net.[url=tcp://server:7046/DynamicsNAV/Service]tcp://server:7046/DynamicsNAV/Service[/url]". SPN Identity: "DynamicsNAV/server:7046.
The X.509 certificate CN=navServiceCert id not in the trusted people store. The X.509 certificate CN=NavServiceCert chain building failed. The certificate that was used has a trust chain that cannot be verified. Replace the certificate or change the certificateValidationMode. A certificate chain could not be built to a trusted root authority"

Thanks in advance


Regards,
RV

tjane

Have you imported the NavServiceCert certificate and its revocation list at the Client PC?

Geff

I have the same problem yet I have imported the NavServiceCert certificate file and the revocation list file ](*,)

tjane

Where to start ... :-k

i have had a lot of (different) problems too, when first trying to implement this Authentication Mode.

The following steps are my short list to remember what to do. Doing so, everything is working fine.

Perhaps you should try from the start, that's what i have done (several times).


On NAV Server Machine:

1. create Certificate per CMD Shell (Run as Administrator):

makecert -n "CN=RootNavServiceCA" -r -sv RootNavServiceCA.pvk RootNavServiceCA.cer


2. import RootNavServiceCA.cer per mmc (sorry, i don't know the exakt Folder Name in English, something with thrustworthy root certificate, i guess)

3. create Revocation List per CMS Shell:

makecert -crl -n "CN=RootNavServiceCA" -r -sv RootNavServiceCA.pvk RootNavServiceCA.crl


4. import Revocation List per mmc (same Folder as in 2.)

5. create Certificate Name per CMD Shell:

makecert -sk NavServiceCert -iv RootNavServiceCA.pvk -n "CN=NavServiceCert" -ic RootNavServiceCA.cer -sr localmachine -ss my -sky exchange -pe NavServiceCert.cer


6. in mmc, update own certficates folder and go to NavServiceCert, manage private keys: allow everything for the account under which the NAV Service is running)

7. copy Thumbprint of NavServiceCert to NAV Service per NAV Administration Console and edit Credential Type too, then restart/start Service

8. edit ClientUserSettings.config


On Client Machine

9. Import RootNavServiceCA.cer and Revocation List (same Folder as in 2.)

10. edit ClientUserSettings.config

You should find detailed information here:
http://msdn.microsoft.com/en-us/library/gg502478(v=nav.70).aspx
and here:
http://msdn.microsoft.com/en-us/library/gg502467(v=nav.70).aspx

Geff

Thanx Tjane. I will certainly start a fresh....though I had actually gone through the whole process you have described. and the only login I was able to make was on the server machine.(On the server machine I am able to login as a client without any problem using either Windows, UserName or NavUserPassword credential type...problem comes when I try to use a remote client) #-o

Geff

Now I get a new error message:
The client machine could not establish a connection to the Microsoft Dynamics NAV server.
FaultCode = 'InvalidSecurity'
Reason = 'An error occurred when verifying security for the message.

Anyone who has encountered this error message and solved it?

Geff

Finally my connection issue is solved ....problem was with the time zones.I had a different time zone on the client machine compared to the NAV server machine...results ---> the NavServiceCert certificate file imported into the client machine set a different expiry date on the certificate file compared to the certificate file on the NAV server machine resulting in an "invalidsecurity" error message. =D>

superpuz

Hi!

have you manage to log in on remote computer? how to solve that?

Geff

superpuz wrote:

Hi!

have you manage to log in on remote computer? how to solve that?

Yes superpuz, I did manage to login using a client machine (Not the server machine) both through the Windows credential type and NavUserPassword credential type.