nickbro

Unfortunately hap is heavily tied to AD. You need to use the wizard to generate the hapconfig file and encrypt the ad password.

You need to change the cycle in nova-t add them into there.

To me then it looks like HAP+ isn't able to get the share permissions because the admin user doesn't have permission to the share/folder structure. The initial query is done via the admin user then it impersonates the other user

The groups should work, if when you query the API it tells you the groups it has it's something else. I know on our setup the folder shares are everyone full control then using NTFS to restrict it. It could be because the admin user doesn't have permission to that shared it can't parse the permissions

make sure write checks are not on. What version of HAP+ are you on?

Can you post the web.config file please?

Yes you do. See the video on

Edit the web.config and look for

It won't SSO, you have to click the sign in button first time. It should auto populate the email address though. Or at least that's the experience I've had with it. Once the user clicks sign in, off it goes

Forgot to take the "Require user signed on" in SCCM last night. Changed my powershell script and because onedrive wasn't installed it didn't work. Whoops. Also: https://docs.microsoft.com/en-us/onedrive/use-group-policy#AutoMountTeamSites I've yet to get it working however, so I still use my PS script. For those who are interested this is my script: #abort if pc is not on 1709 or newer if ([system.Environment]::OSVersion.Version.Build -ge 16299) { $UserUPN = ([ADSISEARCHER]"samaccountname=$($env:USERNAME)").FindOne().Properties.userprincipalname $Encode = [uri]::EscapeDataString($UserUPN) $Encode = $Encode.Replace('-', '%2D') $Encode = $Encode.Replace('.', '%2E') Write-Host "Map Onedrive" cd "${Env:ProgramFiles(x86)}\Microsoft OneDrive" ./onedrive.exe /url:"sync?userEmail=$Encode" sleep 10 #if (Test-Path "$env:USERPROFILE\Crickhowell High School\") { Write-Host "Map Main Sharepoint" ./onedrive.exe /url:"sync?" sleep 10 $groups = ([ADSISEARCHER]"samaccountname=$($env:USERNAME)").Findone().Properties.memberof -replace '^CN=([^,]+).+$','$1'; $ea1 = ([ADSISEARCHER]"samaccountname=$($env:USERNAME)").Findone().Properties["extensionAttribute1"] if ($ea1 -eq "Staff") { Write-Host "Staff" ./onedrive.exe /url:"sync?" sleep 10 } $groups | ForEach-Object { if ($_ -eq "Leadership Team") { #Leadership Write-Host "Map Leadership Team" ./onedrive.exe /url:"sync?" sleep 10 } elseif ($_ -eq "Group_0e208ef6-82a8-4a88-bdd3-a8d811b8bcf1") { #Finance Write-Host "Map Finance Team" ./onedrive.exe /url:"sync?" sleep 10 } elseif ($_ -eq "Group_e3aeecb7-66b9-4937-88fd-469a1aff359f") { #Sports Centre Write-Host "Sports Centre Team" ./onedrive.exe /url:"sync?" sleep 10 } elseif ($_ -eq "Group_eb7c4712-2964-4d76-91d0-e0a3a8dc3fc9") { #IT Team Write-Host "IT Team" ./onedrive.exe /url:"odopen://sync?" sleep 10 } } } else { Write-Host "OS Version Not Supported" } Use as you want. To get the sync command to use: Download QueryString.zip Create c:\temp In Chrome/Firefox go to the sharepoint site (for teams go files > sharepoint site) Click Sync and open the link with QueryString.exe It will output a txt file in c:\temp Copy the contents of that, replace the userEmail with $Encode

Looks like Microsoft have made the latest insider build capable of installing on a per machine basis: https://docs.microsoft.com/en-us/onedrive/per-machine-installation All I can say is: about time

Edit the Web.config file and remove change the setup.aspx line to allow all access then navigate to the setup page

The ad user password is encrypted and is computer specific. So you will need to remove the setup.aspx page block, go to that page and reneter the admin password, this will update the password and reencrypt it

Restore the web.config file and make sure to carefully remove the remove for IIS7+ section

It's something to do with the way AD sends the list of groups to HAP+. v10.6 has a fix for this, but it breaks some other things for some reason

I'm not actively developing this project anymore sorry to say. I would suggest moving to Windows Authentication and Azure App Proxy. It's one of the things we moved to to further reduce the exposure. When I try logging into a test build of hap using the username ;SHOW TABLES, I just get that the username doesn't exist error prompt on the login page. In fact I've banned my ip by trying that too many times. Make sure you have custom errors turned On. Since the code uses a AD Searcher you cannot manipulate AD (write) and it errors out if such a injection attempt is attempted. The core authentication system uses Microsoft's ASP.net AD Membership authentication. Make sure you are using HAP.AD.dll 5.6, And at least v10.5 of the hap

Sometimes a restart can fix things

Anything from ASP.net or HAP

Is there anything in the event log?

Have you tried using the server's FQDN instead of IP?

Ok, hapconfig.xml and disable writechecks

Shouldn't do.

Also try turning off writechecks in the config

with or without the 10.6 ad dll?

It's an odd one as to why 10.6 isn't working as I think I had fixes in 10.6 for the roles not being populated. You can check which roles hap is finding by going to /hap/api/ad/roles/$username. You can try replacing the hap.ad.dll with the one from 10.6