Problem Runnind SSIS Package Protected With Password From MSDB
May 22, 2008
Hello,
I need to run SSIS packages with the 32 bit dtexec version, and I am storing these files into the MSDB package store, in SQL Server 2005. I have chosen to encrypt sensitive data with password, and then to execute the packages with xp_cmdshell.
The problem is that I receive the following message when I try to run it from management studio (when running this, I am logged in with the sa user): exec master..xp_cmdshell 'dtexec /Ser ServerName /SQL "TestFolderPackage" /De "testPass"'
€œMicrosoft (R) SQL Server Execute Package Utility
Version 9.00.1399.06 for 32-bit
Copyright (C) Microsoft Corp 1984-2005. All rights reserved.
NULL
Started: 9:41:29 AM
Error: 2008-05-22 09:41:29.70
Code: 0xC0016016
Source:
Description: Failed to decrypt protected XML node "DTSassword" with error 0x8009000B "Key not valid for use in specified state.". You may not be authorized to access this information. This error occurs when there is a cryptographic error. Verify that the correct key is available.
End Error€?
If I run the same package with the same command specified above, but without sensitive data in it (a simpler version with no passwords and connection strings, it works fine)
exec master..xp_cmdshell 'dtexec /Ser ServerName /SQL "TestFolderPackage"'
If I run the firs package version (with sensitive data and password protected) from the command line, everything works well:
DTExec.exe /ServerName OLAP /SQL "TestFolderPackage" /De "testPass"
I know in ASP.NET when encrypting web.config section, the system stores the decryption keys in a app data folder, and in order to be able to read from the encrypted web.config, the user under which runs the ASP.NET must be granted access to that folder, by running asp_regiis.exe with some parameters. I believe here a have a similar problem, with users not being granted access to encryption keys.
Thanks in advance
We are migrating the SQL Server database from 2000 to 2012 and part of this exercise we are migrating the DTS Package to SSIS Package. we were unable to convert the password protected DTS Package to SSIS Package. Â The DTS Package created in early 2000 and we don't have a password for the DTS Package.Â
Is there a way to remove the password or read the content of the DTS Package?
I have a package (PackageA) with an Execute Package Task that execs PackageB. When I run PackageA I get this error on the Execute Package Task :
Failed to decrypt protected XML node "DTS:Password" with error 0x8009000B "Key not valid for use in specified state.". You may not be authorized to access this information. This error occurs when there is a cryptographic error. Verify that the correct key is available.
PackageB has 'EncryptSensitiveWithUserKey' ProtectionLevel. I'm providing passwords in the dtsConfig so I'm guessing I should change it to 'DontSaveSensitive'?
Interestingly, PackageA also has 'EncryptSensitiveWithUserKey' ProtectionLevel, but I don't get an error about PackageA, just on the task that runs PackageB.
I've built SSIS package and made a job to execute it automatically but it always returns an error. The job returns OK but when we looked at the Log File viewer, it conatins this error log :
Key not valid for use in specified state
Failed to decrypt protected XML node "DTS Password" with error
What's wrong with the package ? Thanks in advance.
I have designed a few SSIS packages in the BI Development studio and deployed them to the msdb database of my SQL server using the generated Deployment Utility.
They deployed and executed just fine, but, I would like to better organize them into folders within the msdb storage area.
Is there a way to tell the project or the generated Deployment Utility to deploy the packages to a specific folder within the SSIS Packages / msdb storage area on the SQL server?
I have a question about where package is stored if you select sqlserver or SSIS package store (msdb). Is both of these going to the same place sysdtspackages90. On one of my systems I was saving as sqlserver but when users created a job they where using SSIS package store msdb. This seems to be working, though I would have thought that they were to different locations. On another system when I did same thing the job failed, and looked like maybe it was running wrong version, but when I resaved project as SSIS package store(msdb) then it did work. Even though I had earlier saved that package under sql server. So on 1 system it looks like they are the same on the other system I am not sure.
So if you can clarify for me what the difference between the two areas are if any?
We have just started using SQL 2005 and released our first few projects to prodcution. We are currently using msdb storage for SSIS packages in production using the 'rely on server storage' for protection level and separating each subject areas by folders under msdb in the management studio.
However some of our DBA's feel that this is not the right approach and we should be storing as XML.
Anyone has any recommendation for either or considerations to be taken when deciding what storage to use?
I am trying to import a password-protected Excel file into SQL Serverusing DTS. I am getting an error that it can't decrypt file. Doesanyone know how I can pass the password to the file during the DTSexecution. Please help.Thanks,Michelle
Hi - I have a master package that executes a series of other packages. Each of these 'sub' packages has the security property Encryption Level set to 'EncryptSensitiveWithPassword'.
The master package has a series of file connections in the Connection Manager, one for each sub package, in which the password of the corresponding sub package is provided.
When I run the master package in BIDS (in interactive mode) it opens each of the sub packages, requests the password and gives the 'Document contains one or more lines of extremely long text' dialog box.
Is there any way to suppress the repeated password requests (seeing as it has already been provided in the Connection Manager) and warnings about long lines of text when executing the master package?
I'm trying to pull certain Filemaker 5 tables into SQL Server 2000 inan automated import job using a file DSN. Everything resides locallyon a Windows XP machine. My process works fine on a test FM file withno password, but with the real FM files, all password protected, itfails with this error:******Error Source: Microsoft OLE DB Provider for ODBC DriversError Description: Unspecified error[FileMaker][ODBC FileMaker Pro driver]An error has occurred whiletrying to gather a list of available tables.[FileMaker][ODBC FileMaker Pro driver][FileMaker Pro]Connect failed.Context: Error calling GetRowSet to get DBSCHEMA_TABLES schema info.Your provider does not support all the schema rowsets required by DTS.******This happens whether or not I supply a password to the SQL Server job.It has been nagging me for days and I can't find any documentation onit. Has anyone else encountered this?Thanks very much.Scott
I have been selecting the option to protect sensitive info in my packages with a password. However, this poses problems when later execute the packages by using the Execute Package Task. The problem is that I am repeated required to input the password before the packages will execute.
I was making this selection in the hope of not tying execution to a partiular user's credentials (my boss may also want to execute these pacakages at some point).
I find this subject confusing. Once I have selected this option, how can I change to another method? Additionally, does anyone have any advice vis a vis best practices in this matter? I want to store connection passwords, etc. in the package so they don't have to be supplied each time but I also want the information to be secure.
I dont know how to arrange situation when application enduser needs to access data in two databases of mssql server concurently in those circumstances that access rights to the data should be restricted by password protected role (whose password is not known to the end user).
Detailed description of problem:
So far there was an application, that manipulated its data, saved in mssql server's database. End user authenticates to application by his (mssql server's) login name and password. The application authenticates the user by connecting to the database with the given name/password credentials, and then the application sets application role with hardcoded name/password. Thus application role sets the access rights for consequent end user's requests, delivered via application to the database server.
The goal is that end user cannot manipulate application database data when connects to the database by other means (e. g. via SQL server Manager), because he does not know the application role's password.
Now suppose that there are two applications (A1, A2), both using the same model for access restrictions. Each of them has its own database (A1DB, A2DB) and its own application role (A1R residing in A1DB, A2R residing in A2DB). End user (login) X can manipulate A1DB data when connects via A1, and A2DB data when connects via A2, and NO data when connects by other means.
Finally suppose that some subset of A2 data (let's say one table) is useful to see also via A1 application. There is no problem to add to A1DB view, that shows data from A2DB table together with A1DB tables. But when the user is connected via A1, he cannot see the data, because query on A1 view fails (user has not access rights on A2 data).
The access rights for A1 enduser cannot be set by no means i know because:
1) I cannot set the rights via public (guest) access because in that case they will be accessible to any users connected by any third party products, which is supposed to be security hole.
2) I cannot set the rights via dbuser or dbrole privileges, because they will not work when connected via A1 application (setting the app role suppresses the db privileges)
3) I cannot set the rights via application role because two application roles cannot be set concurrently.
4) I cannot abandon using application roles mechanism and use database roles mechanism, because db roles cannot be protected by independent password (not known to the enduser).
Please can anybody review my problem and either find the mistake in my approach, or propose other solution? So far I suppose the problem is my ignorance, because I am not great mssql expert.
Hello all, I have read many topics about this error but it doesn't fix my packages in my particular case. The problem is that I access to a database in Oracle using the Ole DB provider for Oracle
I get that the mentioned error when I try to run a job from the agent.
1 - When I set "DontSaveSensitive" to ProtectionLevel I get this error: SSIS Error Code DTS_E_OLEDBERROR. An OLE DB error has occurred. Error code: 0x80040E4D. An OLE DB record is available. Source: "Microsoft OLE DB Provider for Oracle" Hresult: 0x80040E4D Description: "ORA-01017: username/password no valid". This is normal because the connection needs a password.
2 - When I set "EncryptSensitiveWithUserKey" to ProtectionLevel I get the mentioned error: "Failed to decrypt protected XML node "DTSassword" ..
The other options to ProtectionLevel doesn't work neither. I have tried to write the password in the field required...
I have tried many possibilities but nothing new, it doesn't work.
Does anybody have this error with Oracle as source file ???
how do i add a password (ie, what is the exact wording) to the CommandLine in a SQL Agent Job that is running an SSIS package from the File System, pls?
Here is the CommandLine as I currently have it:
/FILE "\dbase01c$SSISPackageDeployment vrscanus_process_uploadscanus_process_upload.dtsx" /MAXCONCURRENT " -1 " /CHECKPOINTING OFF /REPORTING E
I have tried /PWD and /pwd and /PASSWORD already. For these, SQL Job says they are not valid commandLine parameters.
i have a few ssis packages which are scheduled as sql server agent jobs. now after a reboot of the server all the packages jobs don't work anymore. i had to reenter all the passwords for the connection manager in order to make them run again. ist there a way to store the passwords so that the keep available even after a reboot? because it's necessary to restart the server for maintenance resasons.
Something a little wride mysterious is happening with my package when I deploy it to run at the SSIS server instance. Everytime that I try to deploy it (from my local development environment) to SSIS server, my package is not keeping its database user and password.
As the database user and password are the same one we dont need to use the XML setting to keep these data there.
So, does anyone know what could be happening with my package and/or my deployment?
I'm having a problem with saving a password in a SSIS package that is accessing an Oracle database as an external data source. Â I experienced the problem that many people have had with the SSIS package not saving the Oracle password as expected. Â I successfully saved the Oracle datasource password (Password #1) using the "Encrypt sensitive with password" security setting and then setting a separate/new password (Password #2) for the SSIS package. Â I've imported this package into my Integration Services installation, and I can get it to run successfully by manually entering Password #2 when I open the package.
Now I want to pull the SSIS package into a SQL Job Agent, along with some other steps, to run on an automatic schedule. Â My question -- how/where do I embed Password #2 (the one for the SSIS package) in the settings for the SQL Job Agent step that I use to run the SSIS package? Â The SQL Job Agent step settings box prompts me for Password #2 before it will let me edit settings for the package, but it doesn't save that password. Â So when I actually run the whole job, the SSIS package always fails.
I'm learning SSIS, and just started to use SSIS Package Configurations. I want to be able to switch between a dev and prod instance of our database.
I did not specify the password in the Configuration file (XML), figuring it would get it from the package itself. (That will be the same between dev and prod). But once I set up to use the Configuration, I started to get a "Login failed..." message. I added the password to the configuration, and it's the same. I quit using the configuration file at all, and then it works again.
This may be related, but when I show the properties on my connection, it shows stars for the password. When I go to the editor, the password field is blank, and if I test the connection, it fails. I type in the password, and then the connection works. I have the "Save my password" checked, but every time I go back, the password is blank. In fact, if I type in the password for the connection in the editor, and then go to the "All" page, the password is blank. It may be a red herring, but it sure looks like it's not really storing the password, and thus the Configuration file can't connect when it tries to get it. I can type in the password, test the connection (it works), close the editor dialog, open the editor dialog, test the connection again, and since the password is now blank, the connection fails.
What do I have to do to make that password actually stick!?
Without the Configuration file, when I save the package to SQLServer, it will run as a job, in spite of the password appearing to not stick. With the configuration file, it's not even running while still in Studio.
Here are at least some of the version information, which may or may not be useful.
Microsoft Visual Studio 2005 Version 8.0.50727.42 Microsoft .NET Framework Version 2.0.50727
Installed Edition: Professional
Microsoft SQL Server Analysis Services Designer Version 9.00.3042.00
Microsoft SQL Server Integration Services Designer Version 9.00.3042.00
Microsoft SQL Server Reporting Services Designers Version 9.00.3042.00
SQL Prompt 3.5
Thank you for any help you can provide. -thursday's geek
After I had transfered SSIS package to another PC I tried to open package and I got an error. ".. Failed to decrypt protected XML node "PackagePassword" with error . ". It turned out, that the password wasn't saved in a OLEDB connection manager of the Package. However "save password" options checked! But password field was empty.
As soos as I enter password the package executes successfully.
Question: How can I transfer a password for OLEDB Connection within a SSIS package to another developer's VS2005?
In BI Tool SSIS Packages run fine and get data From Oracle and Save it in SQL Server.
Package Protection Level is EncryptSensitivewithPassword.
In BI tool when i open the package it ask password and then run fine.
If i change the Protection Level to Dont save Sensitive,
It does not run fine in even BI tool.
It is fine if i use EncryptSensitivewithPassword.in BI Tool and run it.
Now the problem is that i need to run this package through SQL Job.
so Job give error
"Failed to decrypt an encrypted XML node because the password was not specified or not correct. Package load will attempt to continue without the encrypted information."
hi in my package, some sql operations need the special user name and admin privilage. so how do i create my ssis package so that when it executes it takes the given username and password from the table in some database.
I get an error when trying to open an SSIS package from TFS using Visual studio 2014..
This is the error:
error loading package failed to decrypt protected xml node DTS:Password Key not valid for use in specified state you may not be authorized to view this information
This package has been developed by a person who left the company. I think he had admin permissions on the servers.
I have a package protected by a password - I am already unhappy that to get it to use the configuration file to change connection strings for the production servers I have had to hardcode the password into the config file - very insecure! However, the package now deploys correctly to the production server and will run from there OK, but NOT if scheduled as a SQL Server Agent Job. Thus is because however often I edit the command line to include the password after the DECRYPT switch (which it has prompted me for when I click on the command line tab), the Job Step will not retain it. If I open it up after I have edited it and closed it, the password has disappeared.
I know that if I run dtexec plus the code in the Command Line tab (with the password), the package runs OK.
This is driving me insane! I have read all the other posts and so I tried replacing the SSIS package step with a CmdExec step and pasting that code into there - then I get an OLEDB error..
The code I use is: DTEXEC /SQL "ImportRateMonitoringTables" /SERVER servername /DECRYPT password /CONFIGFILE "D:Microsoft SQL ServerSSISDeploymentsRateMonitoringImportTasksDeploymentImportRateMonitoringTables_Production.dtsConfig" /MAXCONCURRENT " -1 " /CHECKPOINTING OFF /REPORTING E
and I get
SSIS Error Code DTS_E_OLEDBERROR. An OLE DB error has occurred. Error code: 0x8000FFFF
although the same code executes perfectly from a command prompt.
Please does anyone have any experience with a similar problem and if so, how did you get round it?
I'm trying to import data from a Sybase ASE 12.0 database called "OurTestDatabase" into MS SQL Server 2005. I started SSIS Wizard and indicated "Sybase ASE OLEDB Provider" as a source and SQL Native Client as the target. I'm gettign the following error message:
The same data source worked with DTS when we thought we'd convert to MS SQL Server 2000. Is this a bug in SSIS? What can be done? Using ".Net Framework Provider for ODBC" is not a good option because this doesn't allow me to choose any tables from the Sybase source.
Both the OLE DB Connection and ADO.Net Connection in SSIS Package does not remember password.
Im connecting to a SQL Server 2000 box using its sa password as test.
The SSIS package runs fine when you first set up the connection in bids
The bottom line is that SSIS keeps forgetting the password I feed into the two Connections that I'm using. I double-click a connection, type the password in, check "Save my password" and hit "OK" but the password disappears from there whenever I run the package or double-click the connection again.
is there any known workaround for this issue as I would like to schedule my SSIS package using a SSIS Step in a SQL Server 2005 Agent job.
the only thing I found when googling this error was link below but the workaround described here is a little harsh
I created a package for importing data from a flat file to an existing table in SQL Server 2005 using Management Studio and the administrator account working directly on the server through a remote login. I saved the package to MSDB.
I can see the package listed when I connect to Integration Services through Management Studio and expand the MSDB folder. In that location I have the option to run the package and it will run successfully. However, I cannot edit the package.
When I try to create a scheduled job using Sql Server Agent, where the first step is to run the package using the administrator login, the execution fails, and the job history will only tell me that the step failed. The Sql Server Agent log shows that the job started and completed. No error is shown. The Administrative Tools Event Viewer Application log shows only that the job started and failed. Security log shows no errors. System log shows no errors.
What am I doing wrong? How can I edit and schedule this package?
I have a intermittent problem with my ssis packages. I have a couple of packages running on a schedule with SQL Server Agent wich sometimes gives me the following errors in agent history:
Message Executed as user: MyDomainSQLAgentServiceAccount. Microsoft (R) SQL Server Execute Package Utility Version 9.00.1399.06 for 32-bit Copyright (C) Microsoft Corp 1984-2005. All rights reserved. Started: 21:05:00 Could not load package "MSDBMyPackageName" because of error 0x80040E37. Description: Table/view either does not exist or contains errors. Source: Microsoft SQL Native Client Started: 21:05:00 Finished: 21:05:00 Elapsed: 0.047 seconds. Process Exit Code 5. The step failed.
When the package does'nt fails it gives me the following message:
Message Executed as user: MyDomainSQLAgentServiceAccount. Microsoft (R) SQL Server Execute Package Utility Version 9.00.1399.06 for 32-bit Copyright (C) Microsoft Corp 1984-2005. All rights reserved. Started: 21:10:00 DTExec: The package execution returned DTSER_SUCCESS (0). Started: 21:10:00 Finished: 21:10:02 Elapsed: 1.312 seconds. Process Exit Code 0. The step succeeded.
The jobs moves data between the sql server that executes the code and a SQL 2000 database on another server. Does anyone recognize this error?
I am trying to load a ssis package into a folder (lets say SSIS packages) that I created in MSDB but its geeting saved in the root (MSDB) not into the SSIS packages folder...I am doing this thru C#...
I created a package using the ImportExport wizard and saved it to the local Sql server. Under Management Studio I can see the package, can run in, import it, export it BUT how am I supposed to edit (modify the thing) it?
