HAP 9 non domain admin logins

[ianwoolcock]

I know this is something I am doing wrong but am now stuck for ideas. I have tried HAP 9 and HAP 9.6 under both server 2012 and 2008 R2 on both everything goes OK and I can login and see my files. Once I try and login as a standard user I get the message "Either your Username or Password was Incorrect or you do not have permission to access this site." I have tried a number of different accounts.

 

This is running on a standard server so I have altered the local security policy to allow the domain users to login locally, gpupdated restarted and the usual. This makes no difference.

 

Anyone any ideas as this is driving me nuts and I think HAP is a perfect fit for my school.

[nickbro]

Check the web.config file is set.

 

I'd also double check that local logons have been enabled: Nikolay's Blog: Win 2008 R2 + Active Directory. Local Logon.

[ianwoolcock]

Check the web.config file is set.

 

I'd also double check that local logons have been enabled: Nikolay's Blog: Win 2008 R2 + Active Directory. Local Logon.

 

Thanks Nick, I have performed the instructions to modify the web.conf that come up in setup.aspx. Have also tested that the account can login to the member server via the console which is can.

 

Any other ideas?

[nickbro]

Any events in the event log

[ianwoolcock]

Hi Nick,

 

When I log in as me (Enterprise Admin Account) the following appears in the application log, though everything works perfectly:

 

"An error occurred in Home Access Plus+

Page: HAP.Web.API.MyPic

 

 

Creating Directory Search and Searching for then current user

Using filter: (&(objectClass=user) (sAMAccountName=Ian))

Found 1 results, processing 1st result

Found 0 thumnbnailPhotos"

 

When I try loggin in as a standard user nothing in logged in any windows logs.

[nickbro]

Ok, that error can be ignored.

 

Can you provide me with your web.config file please?

[ianwoolcock]

Hi Nick,

 

Below is the web.config from the server 2012 machine but the server 2008 R2 is the same with the IIS 8 lines left intact. I am sure this is me doing something really silly, but I have gone around and around now to the point where I am not sure where I am at.

 

[nickbro]

Ok, that looks all ok, can you try using the web.config file from the v9.0 release, see if that one works, compared to the v9.6 release

[ianwoolcock]

Hi Nick,

 

Still the same error and it also goes into a redirect loop when I sign is as myself.

[nickbro]

Ok, the redirection loop is a known issue with 2012

[ianwoolcock]

I tried the v9 on Server 2008 R2 and got the same result without the looping, standard users still unable to login. Am racking my brains as to what this could be within our environment.

[ianwoolcock]

Still battling with this one, if I try adding the user account as an admin on server I get the same problem, deny login. If I add the account to domain admins then everything works fine. Have run out of ideas now.

 

For Home Access Plus 9 which platform is the best to run it under? Server 2008 / Server 2008 R2 / Server 2012 / Server 2012 R2 ? I have access to all of them and have a VM infrastructure so adding an additional server is not a problem.

[nickbro]

HAP+ works best on IIS 7+, Windows Server 2008 R2 is the version I use and code against.

 

Does your HAP+ install's external access go through a reverse proxy?

[ianwoolcock]

HAP+ works best on IIS 7+, Windows Server 2008 R2 is the version I use and code against.

 

Does your HAP+ install's external access go through a reverse proxy?

 

Hi nick, only testing internally at the moment so no proxying, and everything works perfectly as a domain admin. Is talking to AD as it will login any account that has domain admin rights. I am sure it is something strange in our AD but I can't think what HAP is looking for in AD. I double checked by creating a fresh student account which is a member of domain users. Domain Users have Allow Local login rights on the server. This gave the original error. I then made it a domain admin and it logged in Perfectly.

[nickbro]

Can you go into IIS manager, go into the Website, into the HAP folder, under IIS authentication, go into the properties of the Anon User, and check it's using Application Pool Identity

[ianwoolcock]

Hi Nick,

 

I can confirm that Anonymous Authentication is set to the application pool identity. The application pool is running under .net v4 and that the HAP application is using this pool.

 

Many thanks for your help with this.

 

Ian

[ianwoolcock]

hi Nick,

 

I gave the 9.7 update a go an still no change.

 

Shame HAP fits my needs exactly.

[nickbro]

If it's failing to log in it's something to do with your setup. Usually local logon rights, but could also be if the server isn't joined to the correct domain, or you sit in a forest and certain groups are above you,.

[ianwoolcock]

Hi Nick,

 

It is definitely something to do with our set-up just trying to figure out what HAP is looking for.

 

I have domain users set to allow login locally, we only have one domain which is it is joined to and the doman has never been a forest. HAP is able to browse the domain through the setup interface.

 

Which AD groups is HAP looking at?

[nickbro]

HAP+ just looks for Authenticated users, redirects to the login screen if they aren't logged in.

 

Make sure you don't try and use the browser on the server to access HAP+ as it may not log in.

 

The only other place to check is the web.config file.

[ianwoolcock]

I see, I can login locally to the server (VM) with the accounts that cant access HAP. And I am using chrome on a different computer. I posted the web.config file earlier in this thread.

[nickbro]

Any errors being reported in the Event Logs?

 

Are you just putting the username in? Not UPN or domain\username?

[ianwoolcock]

Nothing generated in event logs on failed attempt. Ironically when I use a domain admin account and it successfully logs in I do get an error in eventvwr, but I have read about that one in another thread, it is below.

 

Am using just the username but have also tried domain\ and full UPN.

 

 

--

An error occurred in Home Access Plus+

 

 

Page: HAP.Web.API.MyPic

 

 

Creating Directory Search and Searching for then current user

Using filter: (&(objectClass=user) (sAMAccountName=Ian))

Found 1 results, processing 1st result

Found 0 thumnbnailPhotos

[nickbro]

can you check the ntfs permissions

[ianwoolcock]

HAP app pool has read to all of it and App_Data folder has write permissions for the app pool. Have also checked that nothing it read only.