Issue launching Project Professional 2007 from Project Server 2007

[Rich]

We have a Medium Farm (Three Tiered) Project Server 2007 implementation.
This implementation has been configured to only support SSL because we are
planning to use this system for both our internal staff and our client staff
for managing a couple of fairly large global projects (one with 3500+ tasks).
We will also be using SharePoint Services to manage a document repository
and KnowledgeBase related to the same projects. At present, we are using
local machine accounts for Aunthentication however, we are planning to
migrate to a membership model in the near future.

Naturely, when working with Large Corporate organizations, we are also
confronted with Corporate security policies and the systems supporting these
policies. So, with our implementation we have the Web Server and Appliction
Server (Project Server and SharePoint) implementations in a tightly
controlled DMZ (applying port-level management controls) and then our
Database server is installed on our inside network. Communication between
the database and application/iis servers is not a problem (very thoroughly
tested).

In addition, our Project Server users are typically located at our client's
sites globally where they must access the internet through a proxy server
which is also very tightly controlled. We have verified that our users are
able to access the Project Server and SharePoint sites over SSL connections
with no problems. However, when attempting to use Project Professional 2007
to interact with the Project Server, we are unable to obtain a connection to
the server and Project Professional will not launch correctly.

Further testing has also revealed that even within our own environment, we
are not able to launch Project Professional from any location (even within
our own network environment) which seems to rule out any interference by the
Proxy's/Firewalls.

Has anyone else had any similar experiences? Does anyone know if Project
Server will interact correctly with Project Professional in a purely SSL
environment (non-secure HTTP is blocked)? Any help anyone can provide will
be appreciated.

 

[Gary L. Chefetz [MVP]]

Rich:

I don't think I can give you a definitive answer, but maybe I can get you
pointed in the right direction. Moving to forms authentication may be the
easiest solution in this case. Usually, you need to give local machine
accounts local logon rights, something that might violate your strict
security requirements. Also, make sure that you set IIS to use Windows
Integrated authentication. The system does not like Basic Authentication,
which seems to crumble across a proxy. Another possibility is to create a
separate domain for your DMZ installation with its own DC. Let us know how
you progress as we can all benefit from your experience.

--

Gary L. Chefetz, MVP
MSProjectExperts
For Project Server Consulting: http://www.msprojectexperts.com
For Project Server FAQS: http://www.projectserverexperts.com

 

[Rich]

Hi Gary,

Thanks for your response. I too am thinking that Forms Authentication may
be the best approach for our particular challenge. The thought of setting up
a unique domain in our DMZ was considered however, that presents some other
unique challenges that I'm not sure we want to undertake right now as I am
the only administrator for this environment (as an additional duty--my
primary duty is as the architect for the fairly large project).

As it stands right now, I'm planning to implement Forms Authentication in
the near future and hoping I can tweak the solution to meet all of the
constraints I'm having to deal with. I will provide another post once we get
this set up and verified.

Rich