Error on first use

According to early versions of the install documentation, accessing the URL https://server.domain.com/[instance]/API/ is all that is required to test that the API has been installed correctly.

However, even if this is successful, accessing the API and trying to get the bearer token results in an http 500 internal server error.

The solution is as follows:

• Log into the server
• Open Internet Explorer
• Browse to this URL:  https://server.domain.com/[instance]/API/auth/ResetKeys
• Then browse to this URL:  https://server.domain.com/[instance]/API/auth/GetPublicKey

After this is done the API should be available.

Troubleshooting

If a subsequent call to the API results in an http 500 error code, the next troubleshooting step is to examine the log folder at /API/logs.

Logging is enabled by default in later releases of the API.  If no log files are being created, then ensure that:

• You are using the latest version of API\Web.config, configured for this instance
• The folder API\logs exists
• The Windows account used for the application pool identity has Modify permission for that folder

Error message "Exception:  Unable to read public key from PentanaApiKey in the store.  Set key manually in web.config or provide permission to MachineKey store."

The Windows account used for the application pool identity must be able to read the key file at C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys.  This error message indicates that the Windows user cannot read the file.

Two possible solutions are:

• Delete the key file, then:
  • Open Internet Explorer (on the server)
  • Browse to this URL:  https://server.domain.com/[instance]/API/auth/ResetKeys
  • Then browse to this URL:  https://server.domain.com/[instance]/API/auth/GetPublicKey
    
    or
    
    
• grant the Windows user read permissions

Locating the key file in C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys

This article is not a guide to Windows administration or Sysinternals' Process Monitor and should not be considered advice or recommendation, but includes information you may find useful.  You should consider the appropriateness of the content in conjunction with other resources and guidance.

The MachineKeys folder contains many randomly-named files, and it can be difficult to know which one is used by the Internal Audit API.

One option is to use a tool such as Sysinternal's Process Monitor.  The procedure would be:

• Run Process Monitor
• Set a filter, for Path contains C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys
• Use your API application to make a query against the API
• the monitoring tool will show the file for which access is denied.  This file can then be removed or have its permissions changed, as described above