Symptoms

ViewFlow does not work in clustered K2 environment (two nodes K2 cluster with two WFEs) displaying application error for ‘/Identity/STS/Windows’, with the following details:

ArgumentOutOfRangeException: Index and length must refer to a location within the string.
Parameter name: length

Diagnoses

One of the possible reasons of this error is incorrect K2 Self Signed certificate on one of your serves. You may obtain special debug version of SourceCode.Security.Claims.Sts.Windows.dll from K2 support to get detailed error information or alternatively just check your certificates as described below.

On each of your K2 cluster nodes perform the following:

Run mmc.exe in elevated mode (Run as Administrator) > File > Add/Remove Snap-in… > select Certificates, click Add > select Computer account, click Finish > click OK.

Expand Certificates – Current User > Personal Certificates and sort certificates in this store by Friendly Name. Select certificate which has “K2 Self Signed Certificate” in its friendly name, right click on it and select All Tasks > Manage Private Keys… Alternatively, you can select Open and check that for this certificate on General tab you have key icon at the bottom and the following text “You have a private key that corresponds to this certificate.”
Repeat this action on all your nodes until you identify certificate that does not have associated private key.
 

Resolution

Once certificate with missing private key has been identified, it is possible to replace it with correct one by exporting it from another node and importing to node that has certificate with missing private key. Replace certificate and try to access View Flow. No IIS reset or K2 host server service restart are necessary.