Failed to store the secret due to no valid master key – AWS Thinkbox Help Centre

When storing a password or setting up usage based licensing configuration with Secrets Management enabled for the first time the following error can occur:

System.InvalidOperationException: Failed to store the secret (/admin/ublsettings/UsageBasedURL) due to an unexpected error. Please see Server's application log for further information.

If you check in the Worker’ s log at the time:

POST https://<REDACTED>:4433/rcs/v1/putSecret returned InternalServerError "" (Deadline.Net.Clients.Http.DeadlineHttpRequestException)
     at Deadline.Net.Clients.Http.HttpClient.b(HttpRequestMessage blp)
     at Deadline.Net.Clients.Http.HttpClient.SendRequestForStream(String method, String uri, String contentType, Dictionary`2 headers, HttpContent httpContent)
     at Deadline.Net.Clients.Http.HttpClient.SendRequest(String method, String uri, String contentType, Dictionary`2 headers, HttpContent httpContent)
     at Deadline.Net.Clients.Http.HttpClient.Post(String uri, Object body, String contentType, Dictionary`2 headers)
     at Deadline.Net.Clients.Http.HttpClient.Post[TRequest,TResponse](String uri, TRequest body, String contentType, Dictionary`2 headers)
     at Deadline.Controllers.RemoteSecretsManagementController.PutSecret(String secretId, String secretString, String description, String username, String password)
  Failed to store the secret (/admin/ublsettings/UsageBasedURL) due to an unexpected error. Please see Server's application log for further information. (System.InvalidOperationException)

And if you check the Remote Connection Server’s log around the same time:

ERROR: DeadlineLoggerMiddleware caught exception method=POST path=/rcs/v1/putSecret remoteip=<REDACTED> exception=System.InvalidOperationException: Could not retrieve valid master key.

This can be fixed by granting the computer running the RCS access to the key.

From a command prompt on a computer using a direct connection run the following command. There are examples of flags to use and expected output at the documentation link included. To
In the samples below replace admin with your Secrets Management admin username.

Get the key name

deadlinecommand secrets ListAllMasterKeys admin
Typically the key is named defaultKey. We use this in the last step so make a note of the name.

Get the server name - You want the long string that looks like 61-3A-02-1B-AF-75-81-2D-AF-52-FB-93-85-E1-19-9F-11-4B-7F-2E-34-A4-83-FC-59-42-19-D2-E3-DA-07-76 in the column named Id in the example

deadlinecommand secrets ListAllMachines admin “*” “*”
Find the machine name where your Remote Connection Server is installed.
Make a note of the Id so we can use it in the last step.

Granting access key - use the two pieces of information you've collected above

deadlinecommand secrets GrantKeyAccessToServer admin defaultKey Id
Replace defaultKey and Id with the values you fetched in the previous two steps.

With that completed re-attempt storing the secret and it should succeed.

FAQ:

What does Error: Repository connection setting is not Direct connection. mean?

This means the computer you’re running the command on is set to a ‘remote’ connection type. Usually the computer running the Remote Connection Server is set to a ‘direct’ connection type, so consider using that computer instead for these commands.
If you’re getting this on your Remote Connection Server machine, use the Change Repository option to set it to Direct Connection. This won’t affect the operation of the Remote Connection Server.

What does “direct connection” and “remote connection” mean?

This refers to the two connection settings a Deadline client can use. A ‘remote connection’ is used when the client is connecting via the Remote Connection Server, and a ‘direct connection’ when a client is connecting to a repository using the file system.

I’m still having issues, what do I do?

Contact the support team at https://www.awsthinkbox.com/support.

Related articles