Authentication Issues

[Reuben Hecquet]

Project 2003 deployment using mixed mode authentication to support
some users who do not have windows domain accounts. However is problem
relating to users who do have accounts but do not logon to their
machines with them.

Using a client that is not a member of the same domain as the Project
server. Have configured IE with the projectserver site as a trusted
site. Have configured it so that it does not pass through windows
authentication in custom level settings for trusted site.

When client goes to projectserver site they are prompted for
credentials and enter a valid account (format of domain\username etc).
Access is fine all works OK EXCEPT portfolio analyser. When you use
this it does not appear to pass through the credentials that were
entered when entering the projectserver site but instead uses the
credentials that the user is logged onto the machine with and hence
fails due to invalid permissions. Is this by design or a feature ?

Will add SSL to a development box and see if using the "Logon using a
different Windows Account" option works correctly.

Any help much appreciated.

Rgds
Reuben

 

[reuben]

The solution to this was to use the security setup designed primarily
for extranets and uses HTTP access when using Portfolio Analyser etc.
This involves using the MSOLAP.ASP as mentioned in the following
article.

http://support.microsoft.com/default.aspx?scid=kb;en-us;279489

You will also need to configure the Analysis Server Extranet Address in
the Admin Page in PWA.

This setup allows you to use Windows Authentication in PS with a
machine that that does not have an account in a trusted domain and you
do not need to logon to the machine with the domain account required
for PS. You will obviously still need a valid Windows Domain User
account to use though when accessing through IE to allow access to PS
if you are configured for Windows Authentication.

Rgds

 

[Gary L. Chefetz \(MVP\)]

Reuben:

It's a good idea to quote back some of the original post when posting
replies more than 30 days out. For folks reading the newsgroup directly on
Microsoft's sites, the messages expire after 30 days.

You should also note that in order to use OLAP via http: protocol, one must
have SQL Enterprise Edition, a big price point obstacle for the average
user.

--

Gary L. Chefetz, MVP
"We wrote the books on Project Server"
http://www.msprojectexperts.com

-