Possible Authentication or IIS issue

[Shon Miles]

Just installed Project Server 2003 and SP1. When on the actual server if
you try to browse to http://dns.address/projectserver you get challenged for
credentials and refused login followed by "HTTP Error 401.1 - Unauthorized:
Access is denied due to invalid credentials. Internet Information Services
(IIS)".

If I browse the same adderss from a workstation it gets into the site.
However, someplaces there are links, like when you click on a risk link, it
tried to load http://NETBIOS.name/url and you will get challenged to login
and it will only accept the Local Administrator account of the Project Server.

It is running in mixed mode.

Any ideas?

 

[Shon Miles]

Wanted to post an update with further information. The WSS features are
installed on the default website. It is running under the App Pool setup for
sharePoint, not the MSPS2003AppPool. When I set it to be the MSPS2003AppPool
and resetiis then try to click on a link under Risks, rather than get the
login box where it will only allow the Local Admin, I get this message:

"The documents, risks and issues features in Project Web Access use Windows
SharePoint Services.
There is a problem establishing a connection with the Web server running
Windows SharePoint Services. Contact your system administrator."

I am assuming because it needs the WSS AppPool? or do I need to set WSS to
use the MSPS2003AppPool?

 

[Gary L. Chefetz [MVP]]

Shon:

This is a Windows Server 2003 quirk. I suggest you add an entry to the hosts
file on the server to resolve this problem.

 

[Gary L. Chefetz [MVP]]

Shon:

This is a separate issue. Because you're logged in using the built-in Admin
account, which is not a Windows Account, the system is warning you because
you MUST have a windows authenticate account to access SharePoint. Because
you're likely to also be a local administrator on the WSS box, you'll likely
get in anyway based on your system logon credentials. Non-Windows
authenticated users can't use SharePoint unless it has been opened to
anonymous access.

 

[Shon Miles]

I am NOT logged in as Local admin. Also if you are refering to a DNS
resolution problem by "Windows Server 2003" and adding an entry to the hosts
file, this is not the issue either, if it was, I would not be able to resolve
the entry using nslookup. All DNS entries resolve just fine.

 

[Gary L. Chefetz [MVP]]

Shon:

Did you say you could resolve the dns name on a workstation but not the
server?

 

[Shon Miles]

DNS resolves on server and on workstation from a command promt, however when
trying to browse to the DNS address in the browser on the server only, like
http://projects.ourdomain.com/projectserver it prompts for login and will not
accept anything and pass to a 401.1

From the client macihne, we have actually narrowed it down to the following
from PWA, under Risks, Issues, and Documents, anytime we click on a link, we
get the login prompt and it will only except the local admin account of the
machine, it will not accept any domain account, even when it is part of the
local administrator group. Something worth noting, is in the title bar of the
login promt, it is trying to pass us to http://NetBios.name/link, rather than
http://DNS.address/link (This part seems to be related to WSS. But we are
not sure why the DNS name will not browse on the server itself when it will
resolve the address.

 

[Gary L. Chefetz [MVP]]

Shon:

For your first issue, browsing on the server, I still suggest that you use a
host file entry. I've seen this time and time again on Win2K3 servers.

To understand your second issue, I need to know how far you've gotten with
your Project Server setup and how you've architected it. Anyone
authenticating with a Windows Account to Project Server, should be, at the
very least, able to get to the public documents folder. Risks and Issues
will not work until you've actually published projects.

 

[Shon Miles]

Im not sure what you have seen where dns resolves but not in IE, and adding
to the hosts file fixed, but that does not make any sence at all.

Just to follow your advise I added the entry in the hosts file and as I
expected it had no effect at all. I can still resolve the IP via the command
promt with ping, nslookup etc, but when typed into IE (on the server) it
challenges for a login, and while on this point, I never said it gets 404
when typing in the URL via DNS, it gets 401.1, adding a host entry assumes it
does not know how to resolve the name to IP, it just does not like using the
name, in fact if I type in http://IP_address/projectserver from the server IE
browser, it will load just fine, and even let me click through on a Risk,
being logged in with my domain account, also with localhost, or NetBios Name,
but with DNS no go.

From a workstation, using anything, IP, NetBios, or DNS, I can get as far as
the list of Risks, then when I click on it, I can only get in if I pass the
local admin login info for the server.

For the second issue, there are projects published already, it is when you
attempt to click on the project under Risks, Issues, etc that the login promt
comes. I should note I just discovered that from the server if I am browsing
via the IP address and click on a Risk it will load just fine as mentioned
above.

As for the architecture, WSS running on the Project Server, and SQL backend
running on a seperate server. So two servers total.

 

[Jeff Machesky]

We are having the same problem with the 401.1 error after upgrading to a 3
server configuration using DNS. Have investigated group security policies
applied on the project server as the possible cause, but no luck resolving
the issue so far. Our next step will be to apply the fix suggested in the
following knowledgebase article:

http://support.microsoft.com/default.aspx?scid=kb;en-us;896861

 

[Shon Miles]

This article, using the first method, fixed the issue of the server not being
able to use the DNS name.

However, I still have the issue from the clients, when clicking on a Risk,
it only allows the Local Admin of the box to authenticate.