Cannot connect to FileDirector Cloud API with .NET application (login failure)

Created by Jeremy Burgess, Modified on Fri, 6 Dec, 2024 at 12:34 PM by Jeremy Burgess

Symptoms

Cannot connect to FileDirector Cloud API using .NET application. The failure happens at the first call to API (login).

Using Fiddler to diagnose the issue removes the issue - i.e. FD API connection works when routed through the Fiddler software.

Cause

Check that the application is using TLS and not depreciated SSL. Legacy code may try to run using an unsupported security protocol.

Resolution

Ensure that the application is explicitly using a compatible / enabled security protocol. This line of code placed within the body of the application (before the API call) will ensure that only TLS is used:

ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12 | SecurityProtocolType.Tls11 | SecurityProtocolType.Tls;

To check which protocols are enabled on your the computer you can run the following from an elevated powershell prompt:

Get-ChildItem -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\' | ForEach-Object {
    $protocol = $_.PSChildName
    $clientEnabled = (Get-ItemProperty -Path $_.PSPath -Name 'Enabled' -ErrorAction SilentlyContinue).Enabled
    $serverEnabled = (Get-ItemProperty -Path $_.PSPath -Name 'Enabled' -ErrorAction SilentlyContinue).Enabled

    if ($clientEnabled -eq 1 -or $serverEnabled -eq 1) {
        [PSCustomObject]@{
            Protocol       = $protocol
            ClientEnabled  = $clientEnabled -eq 1
            ServerEnabled  = $serverEnabled -eq 1
        }
    }
}

If the SCHANNEL\Protocols registry path does not contain any configurations, it usually means the system is using default settings for the supported protocols. You can check for support explicitly using the following script:

# Define security protocols to test
$protocols = @{
    'SSL 3.0' = [System.Net.SecurityProtocolType]::Ssl3
    'TLS 1.0' = [System.Net.SecurityProtocolType]::Tls
    'TLS 1.1' = [System.Net.SecurityProtocolType]::Tls11
    'TLS 1.2' = [System.Net.SecurityProtocolType]::Tls12
    'TLS 1.3' = 12288 # TLS 1.3 is not part of .NET SecurityProtocolType enum, so use raw value
}

# Test each protocol
$results = foreach ($protocol in $protocols.GetEnumerator()) {
    try {
        [Net.ServicePointManager]::SecurityProtocol = $protocol.Value
        Invoke-WebRequest -Uri 'https://www.example.com' -UseBasicParsing -ErrorAction Stop | Out-Null
        [PSCustomObject]@{
            Protocol = $protocol.Key
            Enabled  = $true
        }
    } catch {
        [PSCustomObject]@{
            Protocol = $protocol.Key
            Enabled  = $false
        }
    }
}

# Output results
$results | Format-Table -AutoSize