{"action":"created","issue":{"url":"https://api.github.com/repos/Azure/service-fabric-issues/issues/96","repository_url":"https://api.github.com/repos/Azure/service-fabric-issues","labels_url":"https://api.github.com/repos/Azure/service-fabric-issues/issues/96/labels{/name}","comments_url":"https://api.github.com/repos/Azure/service-fabric-issues/issues/96/comments","events_url":"https://api.github.com/repos/Azure/service-fabric-issues/issues/96/events","html_url":"https://github.com/Azure/service-fabric-issues/issues/96","id":191723246,"number":96,"title":"Using a SecretsCertificate to decrypt a domain user password with attribute Encrypted='true' fails","user":{"login":"serbrech","id":315853,"avatar_url":"https://avatars.githubusercontent.com/u/315853?v=3","gravatar_id":"","url":"https://api.github.com/users/serbrech","html_url":"https://github.com/serbrech","followers_url":"https://api.github.com/users/serbrech/followers","following_url":"https://api.github.com/users/serbrech/following{/other_user}","gists_url":"https://api.github.com/users/serbrech/gists{/gist_id}","starred_url":"https://api.github.com/users/serbrech/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/serbrech/subscriptions","organizations_url":"https://api.github.com/users/serbrech/orgs","repos_url":"https://api.github.com/users/serbrech/repos","events_url":"https://api.github.com/users/serbrech/events{/privacy}","received_events_url":"https://api.github.com/users/serbrech/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2016-11-25T15:22:00Z","updated_at":"2017-01-17T09:33:41Z","closed_at":"2017-01-17T09:33:41Z","body":"My ApplicationManifest is as below : \r\n\r\nPrincipals : \r\n\r\n``` xml\r\n<Principals>\r\n    <Users>\r\n      <User Name=\"SvcAccount\" AccountType=\"DomainUser\" AccountName=\"domain\\serviceuser\" Password=\"MIIBKQYJKoZIhvcNAQcD...rvtewFvicEhHd3Ysi/5ow==\" PasswordEncrypted=\"true\" />\r\n    </Users>\r\n</Principals>\r\n```\r\n\r\nPolicies with SecurityAccessPolicy ResourceType=\"Certificate\" : \r\n\r\n``` xml\r\n<Policies>\r\n      <RunAsPolicy CodePackageRef=\"Code\" UserRef=\"SvcAccount\" />\r\n      <SecurityAccessPolicy ResourceRef=\"ServiceEndpoint\" PrincipalRef=\"SvcAccount\" />\r\n      <SecurityAccessPolicy ResourceRef=\"ServiceEndpointSsl\" PrincipalRef=\"SvcAccount\" />\r\n\r\n      <SecurityAccessPolicy ResourceRef=\"Cert2\" PrincipalRef=\"SvcAccount\" ResourceType=\"Certificate\" />\r\n</Policies>\r\n```\r\n\r\nAnd of course I define the certificates : \r\n``` xml\r\n<Certificates>\r\n    <SecretsCertificate X509FindValue=\"FAEC44B0B0E9456E38A90459218858988C38CD82\" Name=\"Cert2\" />\r\n    <EndpointCertificate X509FindValue=\"FAEC44B0B0E9456E38A90459218858988C38CD82\" Name=\"Cert\" />\r\n  </Certificates>\r\n```\r\n\r\nI run this on the local dev cluster with 5 nodes config, and use a self signed certificate. I know the certificate definition and thumbprint are fine because if I do not encrypt the password I am able to get the https endpoint up and running for my service.\r\n\r\nIt seems that a Certificate Resource is expected in the ServiceManifest.xml, but intellisense at least does not let me add a Certificate in the Service Manifest resource.\r\n\r\nRunning Test-ServiceFabricApplicationPackage : \r\n```\r\nTest-ServiceFabricApplicationPackage -ApplicationPackagePath .\r\nFalse\r\n\r\nTest-ServiceFabricApplicationPackage : The ResouceRef 'Cert2' in SecurityAccessPolicy is invalid. There is no matching Resource in the corresponding ServiceManifest.\r\nFileName:\r\n \r\nC:\\Users\\ode\\AppData\\Local\\Temp\\TestApplicationPackage_440837549664\\kdjjxvh3.4zh\\Debug\\ApplicationManifest.xml\r\nAt line:1 char:1\r\n+ Test-ServiceFabricApplicationPackage -ApplicationPackagePath .\r\n+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n    + CategoryInfo          : InvalidOperation: (:) [Test-ServiceFabricApplicationPackage], FabricImageBuilderValidationException\r\n    + FullyQualifiedErrorId : TestApplicationPackageErrorId,Microsoft.ServiceFabric.Powershell.TestApplicationPackage\r\n```\r\n\r\nI updated the SDK to the latest but that did not help.\r\nI am basically following the doc, confirmed by this answer by stackoverflow answer : http://stackoverflow.com/questions/39126630/how-to-run-a-service-fabric-application-with-different-security-permissions\r\n\r\nThis seems unanswered question seems to be a related issue : \r\nhttps://stackoverflow.com/questions/40601411/azure-service-fabric-securityaccesspolicy-to-access-certificate-for-a-specific# \r\n\r\n"},"comment":{"url":"https://api.github.com/repos/Azure/service-fabric-issues/issues/comments/273065387","html_url":"https://github.com/Azure/service-fabric-issues/issues/96#issuecomment-273065387","issue_url":"https://api.github.com/repos/Azure/service-fabric-issues/issues/96","id":273065387,"user":{"login":"serbrech","id":315853,"avatar_url":"https://avatars.githubusercontent.com/u/315853?v=3","gravatar_id":"","url":"https://api.github.com/users/serbrech","html_url":"https://github.com/serbrech","followers_url":"https://api.github.com/users/serbrech/followers","following_url":"https://api.github.com/users/serbrech/following{/other_user}","gists_url":"https://api.github.com/users/serbrech/gists{/gist_id}","starred_url":"https://api.github.com/users/serbrech/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/serbrech/subscriptions","organizations_url":"https://api.github.com/users/serbrech/orgs","repos_url":"https://api.github.com/users/serbrech/repos","events_url":"https://api.github.com/users/serbrech/events{/privacy}","received_events_url":"https://api.github.com/users/serbrech/received_events","type":"User","site_admin":false},"created_at":"2017-01-17T09:33:41Z","updated_at":"2017-01-17T09:33:41Z","body":"I close this issue since no comment was ever made"}}
{"actor":{"display_login":"serbrech"}}