Tied-Mode Timesheet solution under Novell - Security issue

[jlandry]

Hello,

I have been implementing the solution code (available on CodePlex) since its
first release and never experiment any probleme at all so far. I have been
installing it whithin may PWA environments but always running Windows Server
2003 SP1.

Are there any known issue related to PSI access using the SSP application
pool service account?

Here is my problem:

I cannot get impersonate when trying to set the impersonation context, using
this part of the code:

// Check if surrogate timesheet
//
if (tsHeader.CreatorResUID != tsHeader.ResUID)
{
statusingWS.SetImpersonationContext(resourcePSI.IsWindowsUser,
resourcePSI.WindowsAccount, resourceUID, Guid.Empty, contextInfo.SiteGuid,
contextInfo.Lcid);
}
else
{
// Faster check that calling the resource web service
//
bool isWindowsUser =
contextInfo.UserName.StartsWith("AspNetSqlMembershipProvider") ? false : true;
statusingWS.SetImpersonationContext(isWindowsUser, contextInfo.UserName,
resourceUID, Guid.Empty, contextInfo.SiteGuid, contextInfo.Lcid);
}

Here is the exception occuring continually:

Exception details:
System.Net.WebException: The request failed with HTTP status 401:
Unauthorized.
at
System.Web.Services.Protocols.SoapHttpClientProtocol.ReadResponse(SoapClientMessage message, WebResponse response, Stream responseStream, Boolean asyncCall)
at System.Web.Services.Protocols.SoapHttpClientProtocol.Invoke(String
methodName, Object[] parameters)
at GP3.Service.PSI.WSStatusing.Statusing.ImportTimesheet(Guid periodUID)
at
GP3.Service.PWA.EventHandlers.Timesheet.UpdatedEventHandler.ImportTimesheet(PSContextInfo contextInfo, TimesheetPostEventArgs e)
Pour plus d'informations, consultez le centre Aide et support à l'adresse
http://go.microsoft.com/fwlink/events.asp.

It seems to be related to the fact that my current client is running PWA
under Novell. I even tried to use an account which is administrator
everywhere including the server itself. I even add the account the the "Farm
Adminsitrators" group.

What is making my troubleshooting more complicated, is that even if I enter
the URL of any PSI Web service directly in IE address field, my service
account has the right to see the page (Web Service definition).

But what makes the access impossible using the same account when trying to
call the Statusing.asmx Web Service, trying to import the timesheet using
impersonation?

Any help would be well appreciated.

Regards,

Jean

 

[Christophe Fiessinger [MSFT]]

check this:
http://blogs.msdn.com/chrisfie/arch...asks-tied-mode-customization-on-codeplex.aspx
and run a SQL trace to troubleshoot the 401