Splunk Add-on for Microsoft Cloud Services: When trying to configure inputs, why do I see error "REST ERROR[1021]: Fail to decrypt the encrypted credential information - not well-formed"?

[mvarga2]

I am trying to configure inputs for the Splunk Add-on for Microsoft Cloud Services (Add Azure Storage Account) and continue to receive the following error message: REST ERROR[1021]: Fail to decrypt the encrypted credential information - not well-formed

I uninstalled the add-on, logged in as the administrator to reinstall but still continue to see the same error message. I am also running Splunk Enterprise 6.4.1 on Windows 2012 R2.

2017-01-17 15:08:00,628 +0000 log_level=ERROR, pid=4388, tid=MainThread, file=error_ctl.py, func_name=ctl, code_line_no=145 | REST ERROR[1021]: Fail to decrypt the encrypted credential information - not well-formed (invalid token): line 33, column 37
  File "E:\Program Files\Splunk\bin\runScript.py", line 78, in 
    execfile(REAL_SCRIPT_NAME)
  File "E:\Program Files\Splunk\etc\apps\Splunk_TA_microsoft-cloudservices\bin\splunk_ta_ms_o365_rh_server_forwarders.py", line 74, in 
    admin.CONTEXT_APP_AND_USER)
  File "E:\Program Files\Splunk\Python-2.7\Lib\site-packages\splunk\admin.py", line 129, in init
    hand.execute(info)
  File "E:\Program Files\Splunk\Python-2.7\Lib\site-packages\splunk\admin.py", line 590, in execute
    if self.requestedAction == ACTION_LIST:     self.handleList(confInfo)
  File "E:\Program Files\Splunk\etc\apps\Splunk_TA_microsoft-cloudservices\bin\splunk_ta_microsoft_cloudservices\splunktaucclib\rest_handler\base.py", line 201, in handleList
    ents = self.all()
  File "E:\Program Files\Splunk\etc\apps\Splunk_TA_microsoft-cloudservices\bin\splunk_ta_microsoft_cloudservices\splunktaucclib\rest_handler\base.py", line 463, in all
    return {name: self.decode(name, ent) for name, ent in ents.items()}
  File "E:\Program Files\Splunk\etc\apps\Splunk_TA_microsoft-cloudservices\bin\splunk_ta_microsoft_cloudservices\splunktaucclib\rest_handler\base.py", line 463, in 
    return {name: self.decode(name, ent) for name, ent in ents.items()}
  File "E:\Program Files\Splunk\etc\apps\Splunk_TA_microsoft-cloudservices\bin\splunk_ta_microsoft_cloudservices\splunktaucclib\rest_handler\base.py", line 352, in decode
    ent = self._cred_mgmt.decrypt(self._makeStanzaName(name), ent)
  File "E:\Program Files\Splunk\etc\apps\Splunk_TA_microsoft-cloudservices\bin\splunk_ta_microsoft_cloudservices\splunktaucclib\rest_handler\cred_mgmt.py", line 123, in decrypt
    shouldRaise=True)
  File "E:\Program Files\Splunk\etc\apps\Splunk_TA_microsoft-cloudservices\bin\splunk_ta_microsoft_cloudservices\splunktaucclib\rest_handler\error_ctl.py", line 142, in ctl
    if logLevel >= logging.ERROR or isinstance(msgx, Exception) \
Traceback (most recent call last):
  File "E:\Program Files\Splunk\etc\apps\Splunk_TA_microsoft-cloudservices\bin\splunk_ta_microsoft_cloudservices\splunktaucclib\rest_handler\cred_mgmt.py", line 118, in decrypt
    creds = cred_mgr.get_clear_password(username)
  File "E:\Program Files\Splunk\etc\apps\Splunk_TA_microsoft-cloudservices\bin\splunk_ta_microsoft_cloudservices\splunktalib\credentials.py", line 286, in get_clear_password
    return self._get_credentials("clear_password", name)
  File "E:\Program Files\Splunk\etc\apps\Splunk_TA_microsoft-cloudservices\bin\splunk_ta_microsoft_cloudservices\splunktalib\credentials.py", line 300, in _get_credentials
    all_stanzas = self.get_all_passwords()
  File "E:\Program Files\Splunk\etc\apps\Splunk_TA_microsoft-cloudservices\bin\splunk_ta_microsoft_cloudservices\splunktalib\credentials.py", line 212, in get_all_passwords
    all_stanzas = self._get_all_passwords()
  File "E:\Program Files\Splunk\etc\apps\Splunk_TA_microsoft-cloudservices\bin\splunk_ta_microsoft_cloudservices\splunktalib\credentials.py", line 275, in _get_all_passwords
    return xdp.parse_conf_xml_dom(content)
  File "E:\Program Files\Splunk\etc\apps\Splunk_TA_microsoft-cloudservices\bin\splunk_ta_microsoft_cloudservices\splunktalib\common\xml_dom_parser.py", line 20, in parse_conf_xml_dom
    xml_conf = et.fromstring(xml_content)
  File "", line 124, in XML
ParseError: not well-formed (invalid token): line 33, column 37

Has anyone else seen this?

Thank you.

[stockwee]

passwords.conf file may have unsupported character or corrupted password. *** Note the passwords.conf could be located in a different app. For us, we could not configure any new account for the Splunk Add-on for Microsoft Cloud Services. Deleting the passwords.conf in "Splunk_TA_snow" (on the deployment server) fixed the issue for the Splunk Add-on for Microsoft Cloud Services.

[wjurgens]

I have also ran into this issue. Has anyone found a resolution to this problem?

[pedrolito]

Hi mvarga2,

Have any update on this issue, as I am experiencing the same right now ?

Thank you.

Cheers

[mvarga2]

I believe we installed the app on a new HF box and the issue resolved itself. It was either conflicting with some other app or the instance of Splunk I was using was dirty and needed to be rebuilt.