HAP installed, but errors when anyone logs on

[ashleyturner86]

Hi All,

 

I'm hoping someone out there may be able to help me with this. I've installed HAP as per the documentation and video guides, and gone through the initial configuration (with the setup.aspx page). You can successfully browse to the external FQDN of the HAP server, and see the login box, but get errors when logging in.

Whether I try as a domain administrator, pupil or staff user, once you've entered your credentials, you get prompted with a "The Website declined to show this webpage" page. You can then click on the "Go back to the previous page" link, which takes you into the HAP website (can see the menu bar on the left etc.), but there's a warning saying "You have attempted to access a restricted resource". If you attempt to use the icons on the menu bar to go anywhere (user's files, booking system etc.), you then get the same "website declined" error.

 

I've not changed the configuration of the web.config file at all, other than as prompted to, to restrict access to the setup.aspx website, and to cure the known issue by removing the entry for .svg files. The same thing happens from IE8, 9 & Chrome.

 

Any thoughts?

[nickbro]

Check the web.config files in the sub folders, some of them have other permissions set.

 

Also make sure you have local logon rights on the server for the users who need to use HAP+

[ashleyturner86]

Hi Nick,

 

I've checked the other web.config files, but can't see anything that strikes me as problematic.

When you say to check that users have "local logon rights" on the server, what exactly do you mean? Users can't current logon to the actual server hosting HAP (which I don't think is unreasonable?).

[nickbro]

HAP+ requires local logon rights on the server hosting hap+ for identity impersonation to work. Which is why most of the HAP+ users run HAP+ on a terminal server

[ashleyturner86]

Hi Nick,

Okay thanks - didn't realise that was the case, and don't remember seeing anything about that in the instructions.

 

However, the policy being applied to the server hosting HAP already has "administrators" listed as allowed to log on locally, but yet when I login with a systemadmin user, it still gives the error. I.e. I guess the "allow log on locally" setting could be relevant later to get staff and students working, but I can't see that it's relevant for my systemadmin user, which is suffering from the same issue.

[nickbro]

Very odd, it should work for domain admins stright out the box

[ashleyturner86]

It unfortunately hasn't done for me.

I've even totally trashed everything and started again (the AppPool in IIS, the website itself, the extracted contents from the ZIP installer etc.), but still had exactly the same issue.

I am however using HAP v8 (latest available from the site), and all the instructions are aimed at v7. Can't see that anything is drastically different though

[nickbro]

Have you enabled local logon rights for everyone? It does need it.

 

What is the exact error?

[ashleyturner86]

I've not yet enabled local logon rights for everyone, but as previously mentioned, that is enabled for "administrators", so shouldn't be affected the use for my "systemadmin" user.

 

You browse to the URL, and the login page successfully loads. I enter the systemadmin credentials, press "login", and it then loads a plain white page, with the error "You do not have permission to view this directory or page."

If I then press the "back" button in the browser, I can see a HAP screen (title bar is there, along with the side menu bar, and the "logout" link), but the minute I try and do anything (such as click on the "my files" icon), exactly the same page as above is displayed with the same error.

[nickbro]

Can you post your ~/web.config file, I'll have a look and see if I can see anything

[ashleyturner86]

Nick,

 

Contents of web.config below. I've not made any changes to it other than those described to lock down the setup.aspx page, and removing the entry for .svg as per another post.

 

 

 

[nickbro]

Ok that looks all ok, can you now post your hapconfig.xml file, removing your ad password

[ashleyturner86]

Hi Nick,

 

Please see below.

The AD username and domain fields were both in clear text as expected, but the password was a string of gobbledygook - I presume this is also expected, and is actually somehow encrypted??

 

\\MFS-SR-01\RMStaff

\\MFS-SR-01\RMShared Documents

\\MFS-SR-01\%username%$

\\MFS-SR-01\%username%$

[nickbro]

The password is hashed, for security.

 

What's your UPN?

 

It looks like an RM school, which CHS is, and it works fine. Which server are you running HAP+ on? i.e. Web Server 2008 R2, FRDC Server 2003

[ashleyturner86]

It is indeed an RM school. A single CC4.3 server setup (i.e. Server 2008 R2) - HAP is therefore installed on the CC4 FRDC.

The UPN is "SchoolName.internal".

[nickbro]

ok, that should work, but it's preferred to run HAP+ on a separate server to avoid issues. You will need to allow local logon rights to all users on the FRDC

 

Grant a Member the Right to Logon Locally

[ashleyturner86]

Hi Nick,

 

As per the details I previously mentioned, anyone that's already a member of the administrators group already has local logon rights - therefore, my "systemadmin" user already has this level of access, but yet still suffers from this issue.

 

I.e. adding in "all users" (or those who I want to be able to use HAP) to have local logon rights, will surely make no difference to this fundamental issue affecting systemadmin?

[nickbro]

Ok, sorry I get confused between support calls some times. The only thing I can think of trying is running HAP+ on another pc to see if it works outside of the FRDC