xConnect The HTTP response was not successful: Unauthorized

Question

I'm trying to initialize a connection between a .NET Core application and an xConnect installation.
I ran into the following error:

   An unhandled exception of type 'Sitecore.XConnect.XdbCollectionUnavailableException' occurred in mscorlib.dll
    The HTTP response was not successful: Unauthorized

Here is the stack trace:

at Sitecore.XConnect.Client.WebApi.ConfigurationWebApiClient.d__4.MoveNext()
    --- End of stack trace from previous location where exception was thrown ---
    at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
    at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
    at Sitecore.XConnect.Client.XConnectClientConfiguration.d__32.MoveNext()
    --- End of stack trace from previous location where exception was thrown ---
    at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
    at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
    at System.Runtime.CompilerServices.TaskAwaiter.GetResult()
    at CashRegisterApplication.Controllers.RegisterController.d__7.MoveNext()

   End of stack trace from previous location where exception was thrown ---
    at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
    at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
    at System.Runtime.CompilerServices.TaskAwaiter.GetResult()
    at CashRegisterApplication.Controllers.RegisterController.d__4.MoveNext()

I've been looking for what is causing this error for a while now but I can't find any leads, has anyone seen this before or does anyone have tips where I can start looking?

EDIT:

I decided not to include this because I have no clue if it has anything to do with it but on second thought it could ring a bell for someone so here it goes:
The Collection.ShardMapManager database was created without a user, I added this user myself. I think it might have something to do with that. This post showed me there was no account configured for that database:

https://www.kasaku.co.uk/2017/11/05/sitecore-xconnect-shard-map-must-be-configured/

Answer 1

UPDATE: Added mark's solution to help those looking for answers.

I can think of a few possible reasons you are getting an unauthorized issue:

1. Your thumbprint or certificate is not properly installed so you are being blocked from connecting to xConnect
2. Your application does not have access to the certificate (e.g. IIS user does not have permission)
3. You did not execute the script in the installation guide Post-installation steps.

In the 9.0 Initial release installation guide, the following script needs to be executed. Remember to update user name and password to the appropriate ones for your system.

:SETVAR DatabasePrefix xp1
:SETVAR UserName collectionuser
:SETVAR Password Test12345
:SETVAR ShardMapManagerDatabaseNameSuffix _Xdb.Collection.ShardMapManager
:SETVAR Shard0DatabaseNameSuffix _Xdb.Collection.Shard0
:SETVAR Shard1DatabaseNameSuffix _Xdb.Collection.Shard1
GO
IF(SUSER_ID('$(UserName)') IS NULL)
BEGIN
 CREATE LOGIN [$(UserName)] WITH PASSWORD = '$(Password)';
END;
GO
USE [$(DatabasePrefix)$(ShardMapManagerDatabaseNameSuffix)]
IF NOT EXISTS (SELECT * FROM sys.database_principals WHERE name = N'$(UserName)')
BEGIN
 CREATE USER [$(UserName)] FOR LOGIN [$(UserName)]
 GRANT SELECT ON SCHEMA :: __ShardManagement TO [$(UserName)]
 GRANT EXECUTE ON SCHEMA :: __ShardManagement TO [$(UserName)]
END;
GO
USE [$(DatabasePrefix)$(Shard0DatabaseNameSuffix)]
IF NOT EXISTS (SELECT * FROM sys.database_principals WHERE name = N'$(UserName)')
BEGIN
 CREATE USER [$(UserName)] FOR LOGIN [$(UserName)]
 EXEC [xdb_collection].[GrantLeastPrivilege] @UserName = '$(UserName)'
END;
GO
USE [$(DatabasePrefix)$(Shard1DatabaseNameSuffix)]
IF NOT EXISTS (SELECT * FROM sys.database_principals WHERE name = N'$(UserName)')
BEGIN
 CREATE USER [$(UserName)] FOR LOGIN [$(UserName)]
 EXEC [xdb_collection].[GrantLeastPrivilege] @UserName = '$(UserName)'
END;
GO

Answer 2

I've encountered the SAME EXACT PROBLEM on my local machine. Had to scratch my head for 2 days, had to also ask help from a colleague to also help; troubleshoot it together - 2 brains are better than 1 - to just simply fix this. A bit troublesome.

First of all, follow what Jay S recommended and that will save a lot of your troubleshooting time, won't repeat it here.

After that, try this - if it didn't make sense, you'll never know.

IN MICROSOFT MANAGEMENT CONSOLE:

• Remove unused SC certificates from your 'current user' certificate stores. Maybe for some reason, you have it there.
• Type 'mmc' and open your Certificate Store for 'Local Computer'. Right-click your Sitecore certificate > All Tasks > Manage Private Keys. Grant full control to both NETWORK SERVICE and IIS_IUSRS. Do it for both xp0.xconnect and xp0.xconnect_client certificates.

• Potentially, you have untrusted certificates in your 'Trusted Root Certification Authorities'. I have one, and I removed it. You can check this post for more details: https://stackoverflow.com/questions/26247462/http-error-403-16-client-certificate-trust-issue

This PowerShell command will identify non-self-signed certificates:

Get-Childitem cert:\LocalMachine\root -Recurse | 
    Where-Object {$_.Issuer -ne $_.Subject}

Move these non-self-signed certificates into the Intermediate Certification Authorities (i.e. CA) store

Get-Childitem cert:\LocalMachine\root -Recurse | 
    Where-Object {$_.Issuer -ne $_.Subject} | 
    Move-Item -Destination Cert:\LocalMachine\CA

IN IIS:

• From your xp0.xconnect website, open your bindings and double-check the SSL certificate as it has to be valid.
• From the Application Pools, change the identity to NETWORK SERVICE
• Do IISRESET and clear your Sitecore Logs

YOU SHOULD ABLE TO SEE THIS IF EVERYTHING GOES INTO PLAN FROM YOUR SITECORE LAUNCHPAD:

And when you access the https://xp01.xconnect, it should give you this kind of result.

[UPDATED]

• Forgot to mention, try to restart your laptop too.
• Grant permission to your logged in user to xp0.xconnect as well.

Answer 3

Another thing to check is that in the SSL settings of the xconnect site the

Client certificates are accepted.

Answer 4

Like Jay said:

Your thumbprint or certificate is not properly installed so you are being blocked from connecting to xConnect.

I had a very though time finding out what the problem might have been. It turned out my IIS user did not have permission to see the Certificate. Once i gave my logged in user rights to see the Certificate i could establish a connection.

Answer 5

If you're on Azure you might want to check:

• Certificates are loaded on all roles that access xConnect
• The app setting WEBSITE_LOAD_CERTIFICATES is set to the certificate thumbprint
• If you're using self-signed, make use you have <add key="AllowInvalidClientCertificates" value="true"/> in your web config
• In the AppPool of all roles, in SSL Settings, have Incoming Client Certificates set to true

Answer 6

I ran into this issue while replacing the self-signed certificate with Production Certificates, after updating the Certificate Thumbprint successfully on all the x-Connect Services Config files and also on Content Management Server, and Analytics Dashboard showing up nicely, however after updating the certificates, the "Sitecore Marketing Automation" service stopped and started throwing error message "Could Not start Windows Service, Error 1064.." and in MarketingAutomation logs there was an error "Sitecore.XConnect.XdbCollectionUnavailableException". I double checked the thumbprints in all config files, the thumbprint was all good. Also checked for any non-self-signed certificates, by executing the below PowerShell script to find out:

Get-Childitem cert:\LocalMachine\root -Recurse | Where-Object {$_.Issuer -ne $_.Subject}

It returned nothing, means there was no non-Self-Signed certificate that's causing the issue. Finally, I realized that when I installed the Production Certificate, I have not given access to Local Service account and Network Services to that Certificate. And so the Service account under whose context xConnect Services were running didn't have access to cert. After adding the Service accounts to cert(via manager Private Key), "Sitecore Marketing Automation" started working and logs no error reported in the logs.

Answer 7

For me, it said - An unhandled exception of type Sitecore.XConnect.XdbCollectionUnavailableException occurred in mscorlib.dll The HTTP response was not successful: Internal Server Error

I solved it by going to Windows features and enabling asp.net 4.6 under Application development Features node in IIS web server roles.

Answer 8

I had the same issue. I've checked every answer from this question and it didn't work.

I the act of desperation I recycled xConnect app pool from the IIS Manager and it started to work after that.

I don't know why it needed a manual recycle, the xConnect site was already restarted and I was able to open it in a browser and I saw that the valid certificate was used. But anyway, it did the trick for me so I'm adding my answer here just in case anyone else has the same issue.

Answer 9

We encountered a similar issue with the The HTTP response was not successful: Unauthorized error in our On-Prem Sitecore instance after switching from self-signed certificates to authorized wild-card certificates. The logs were flooded with exceptions

Exception: Sitecore.XConnect.XdbCollectionUnavailableException
Message: The HTTP response was not successful: Unauthorized
Source: Sitecore.Xdb.Common.Web
   at Sitecore.Xdb.Common.Web.Synchronous.SynchronousExtensions.SuspendContextLock[TResult](Func`1 taskFactory)
   at Sitecore.XConnect.Client.XConnectSynchronousExtensions.SuspendContextLock(Func`1 taskFactory)
   at Sitecore.XConnect.Client.Configuration.SitecoreXConnectClientConfiguration.Initialize(XmlNode configNode)
   at Sitecore.Configuration.DefaultFactory.CreateObject(XmlNode configNode, String[] parameters, Boolean assert, IFactoryHelper helper)
   at Sitecore.Configuration.DefaultFactory.CreateObject(XmlNode configNode, String[] parameters, Boolean assert)
   at Sitecore.Configuration.DefaultFactory.CreateObject(String configPath, String[] parameters, Boolean assert)
   at Sitecore.XConnect.Client.Configuration.SitecoreXConnectClientConfiguration.GetClient(String clientConfigPath)
   at Sitecore.Analytics.Aggregation.XConnect.DefaultXdbContextFactory.CreateReadOnly()
   at Sitecore.PathAnalyzer.Processing.Agents.TreeAggregatorAgent.Execute()
   at Sitecore.Analytics.Core.BackgroundService.Run()

To address this, we had to ensure a few key points:

1. Verify Trusted Root Certificates:

The issue was that our organization's wild card certificate which is a non-self-signed certificate was present on the trusted root. You can run the below command in PowerShell to ensure that the trusted root does not contain non-self-signed certificates using the following PowerShell script:

Get-Childitem cert:\LocalMachine\root -Recurse | Where-Object {$_.Issuer -ne $_.Subject}

If any non-self-signed certificates are present, move them to the Intermediate Certification Authorities by running the below command:

Get-Childitem cert:\LocalMachine\root -Recurse | Where-Object {$_.Issuer -ne $_.Subject} | Move-Item -Destination Cert:\LocalMachine\CA

2. Adjust SSL Settings in IIS for xConnect:

Ensure that xConnect instances accept Client Certificates, to do that:

• Select xConnect site in IIS.
• Click the SSL Settings icon in the IIS section and ensure that the configuration looks as follows:

After implementing these changes, our xConnect instances started accepting client certificates correctly, and the "Unauthorized" issue was resolved.