Wednesday, May 6, 2009

“Access is denied” entries in SharePoint Search logs and authentication prompts

 

During the Spring of 2009 we were implementing several MOSS 2007 farms for one of my clients. The environment was: MOSS 2007 SP1 w/Infra Update, Windows 2008/IIS7, IE6/7 client. The index servers were dedicate web front end index servers. We were experiencing the following issues:

The issue:

While administrators were remote desktop’d (RDP’d) on any of the web front end servers, they would browse to the Shared Service Provider (SSP) administration page and get authentication prompts.

We were also experiencing the following “Access is denied” errors in the search logs:

Access is denied. verify that either the default content access account has access to this repository or add a crawl rule to crawl this repository. if the repository being  crawled is a sharepoint repository verify that the account you are using has full read permissions on the sharepoint web application being crawled. the item was deleted because it was either not found or the crawler was denied access to it.

The authentication prompts would occur when browsing to the SSP admin page served by the same web front end the administrator was RDP’d on. The “access is denied” errors would appear when indexer crawled itself as a dedicated WFE/indexer.

After doing some research, I discovered several articles on the internet that mentioned disabling loopback checking should be done for SharePoint implementations. I learned many folks implementing MOSS on Windows 2008 forget to disable loopback checking (including myself). This caused various issues including those that I experienced.

Here is another error that may occur with IIS6 and Windows 2003 with SP1 due to this setting:

HTTP 401.1 - Unauthorized: Logon Failed.

This issue occurs when the Web site uses Integrated Authentication and has a name that is mapped to the local loopback address. Please refer to this link: http://support.microsoft.com/default.aspx?scid=kb;EN-US;896861

Windows 2008 has this security feature enabled be default. In fact, SP1 for Windows 2003, I understand, enables loopback checking  also.

The solution:

Disable loopback checking on your SharePoint servers. To do that, do the following:

1. Click Start, click Run, type regedit, and then click OK.
2. In Registry Editor, locate and then click the following registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
3. Right-click Lsa, point to New, and then click DWORD Value.
4. Type DisableLoopbackCheck, and then press ENTER.
5. Right-click DisableLoopbackCheck, and then click Modify.
6. In the Value data box, type 1, and then click OK.
7. Quit Registry Editor, and then restart your computer.

Additional references:

Thursday, March 5, 2009

SharePoint Infrastructure Update may cause “Internet Explorer cannot display the webpage” errors

 

Hi folks-

Around February 2009, while implementing a MOSS farm for a client we experienced a nerve racking situation regarding appending default.aspx at the end of our URLs. We spent a couple of days trying to research and figure out what was wrong till we called MS Premier Support and viola! Microsoft gave us a hotfix to resolve a bug that was applied when installing the SharePoint Infrastructure Update.

More specifically, here was our scenario:

The client is using port 31000 for a SharePoint web application. However, the web application is fronted by a load balancer where users will browse to the web application via port 80. So the path through the balancer is

Client uses http://url:80 -> load balancer -> IPaddress:31000 on the WFE

Instead of managing multiple dedicated IP addresses or host headers, the client uses the same IP address on the server but different ports for each respective web  application: 31000, 31001, 31002, etc.

The environment was: MOSS 2007 SP1 w/Infra Update, Windows 2008/IIS7, IE6/7 client, CSS load balancer.

Alternate access mappings:

Internal http://intranet.mysite.com -> Public http://intranet.mysite.com default
Internal http://intranet.mysite.com:31000 -> Public http://intranet.mysite.com default
The Issue:

What was happening was when a user browses to the load balanced URL, such as http://intranet.mysite.com/sites/test/default.aspx the user will get the site just fine. HOWEVER, when the user browses to http://intranet.mysite.com/sites/test, without the default.aspx at the end, the user gets the IE error

Internet Explorer cannot display the webpage
Most likely causes:
- You are not connected to the Internet.
- The website is encountering problems.
- There might be a typing error in the address.

On the client machine, we were running HTTPwatch to watch  the HTTP traffic. We were seeing that when browsing to http://intranet.mysite.com/sites/test there is then a redirect 302 to http://intranet.mysite.com:31000/sites/test/default.aspx. We noticed that something (WSS or load balancer) appended the 31000 port number to the load balanced URL, which is incorrect.

When we bypass the load balancer with http://intranet.mysite.com/sites/test, it will get users to the site fine and will append default.aspx automatically as it should.

The solution

This issue was fixed with a Microsoft Hotfix. More specifically with this hotfix: http://support.microsoft.com/kb/956248 we got from MS Premier Support. The SharePoint Infrastructure Update actually applies a bug to the farm that causes the issue. The hotfix article describes the issue it is resolving quite simply as:

“When you install the Infrastructure Update in a SharePoint farm that uses Alternate Access Mapping with a reverse proxy or with a network load balancer, such as in an extranet deployment, some public URLs may become unresponsive…”

You may never run across this issue if your client uses host headers with one IP (port 80), dedicated IP addresses (port 80) or doesn’t have an extranet implementation. This specific client I worked with uses the same IP address with different port addresses on the WFEs and users accessing the sites over port 80 through a load balancer, as I mentioned earlier.

Very important, you must also have two Alternate Access Mappings as you see below in my case:

Internal http://intranet.mysite.com -> Public http://intranet.mysite.com default
Internal http://intranet.mysite.com:31000 -> Public http://intranet.mysite.com default

Hopefully, you do not go through this as we did – we lost a couple of days to troubleshoot it. So, I’m sharing this with you. Since this was a Microsoft bug, our client got their MS Premier Support hours back, but we didn’t get the lost hours of our lives back ;-)

 

Technorati Tags: ,,

Monday, February 23, 2009

eRoom to SharePoint Migration Approach

Intro

This blog will be one of a series of blogs that will discuss suggestions or best practices on migrating content from platforms such as Documentum eRoom and Lotus Notes to Microsoft SharePoint 2007. As a consultant for EMC Consulting, I’ve done a couple of these migrations and have some knowledge to share on how to do these types of migrations. EMC Consulting has done quite a few eRoom to SharePoint and Notes to SharePoint migrations over the past few years.

Our migrations utilized commercial migration tools. I don’t intent on discussing any approach or process that works specifically with any one migration tool. For the most part, approaches, processes and workflows I describe will be general and high-level enough to be migration tool agnostic.

Suggested eRoom to SharePoint migration approach

When developing an eRoom migration approach you will want to develop an approach that is efficient and can be repeatable for each eRoom being migrated. Needless to say, the migration should provide the best end-user experience possible while minimizing the burden on support personnel. One approach I found that worked for a number of eRoom migration engagements is a repeatable process that is broken down into a few phases each with tasks executed by different roles in the organization doing the migrations. The phases look like the following:

Preparation Process
eRoom Freeze
Migration
Verification and Acceptance
SharePoint Site Release
                                                  

The migration for each eRoom would execute each phase in the order you see them in the table described above. While the details of each process will more or less be different for each organization conducting migrations, I think the following points are a good start for what each phase would entail:

Preparation Process

This process can be carried out by the individual owners or coordinators of each eRoom site and/or IT engineering people, to facilitate the automated process and to limit the amount of fine-tuning needed on the target SharePoint site. This may have and not be limited to the following tasks:

  • Develop a list of users
  • Provide references to end-user Training
  • Remove any unwanted items before migration
  • Run a pre-scan report to evaluate degree of difficulty to determine level of effort
eRoom Freeze

To preserve data integrity, this is the agreed upon date and time for all additions or modifications to the existing production eRooms to stop and allow the migration to proceed without user conflicts. The eRoom will usually be set to read-only and end-users would be notified during this phase.

Migration

This is the actual migration of the eRooms to SharePoint by way of automated or semi-automated means usually with the aid of a migration tool.

Verification and Acceptance

This phase entails validation of the migrated content on the new SharePoint site(s) by the individual eRoom owners or coordinators. You can compare inventories taken of the eRoom and new SharePoint site. They would also confirm security has been migrated with the content and that users can begin working in SharePoint.

SharePoint site release

The steps taken to make the new SharePoint site available for users. Usually, the original eRoom will still be accessible and set to read-only.

Other important Activities

Prior to migrating your eRooms, there are a number of things that you may want to do or even have to do to ensure successful migrations and improved end-user experience. Aside from a good project plan, this would include the selection of a migration tool, SharePoint configuration tweaks, eRoom tweaks and proper end-user communications:

Migration tool Selection

Migration tool selection can be a time consuming task because you will want to do the proper due diligence for selecting the right tool for your organization. This would mean applying a well thought out systematic approach that can include critical selection criteria, questionnaires to vendors, a repeatable test procedure you would run against each competing product, and scheduling of demonstrations from each vendor.

Documented critical success criteria will serve multiple purposes. It will allow you to execute a logical and systematic approach to selecting your tool. It can also be part of a questionnaire to the vendors you are considering for your project. Very importantly, you will eventually need to get approval from management for the purchase of a tool. A documented approach with documented selection criteria and test results for each tool tested will be  justification for your final decision on the tool – this is the formal documentation you present to management when you’re asking them for the money to buy the tool :)

An example I have of Critical Success Criteria would be in the form of a spreadsheet and can also be used as a questionnaire to the vendors. The criteria would look something like, yet not be limited to, what you see below:

Does not go to the vendor Does not go to the vendor
General

Criticality

Rating

Score (criticality x rating)

Does it require a staging storage location      
Does the tool require remote agents      
Can the migration tool be run on a separate server (other than the eroom or a MOSS server)      
Can the tool be run remotely      
Is the tool compatible with the latest eRoom version      
Is the vendor in good financial standing      
Does the vendor have case studies to present      
       
Specific Tool Functionality      
Does tool provide options to create site collections and/or subsites      
Do default eRoom roles migrate to default SharePoint groups      
Does the tool migrate custom eRoom roles      
eRoom folder to SharePoint document library permissions      
Does the tool migrate eRoom document item permissions      
Does tool assign/mapping metadata during migration      
Does tool assign or map content types during migration      
Are documents checked-in after migration      
Does tool migrate calendars      
Does tool merge calendars      
Does tool migrate project plans      
Does tool migrate project plan attachments      
Does tool migrate databases      
Does tool merge eRoom databases      
Does tool migrate database attachments      
Does tool translate links to new MOSS links (internal)      
Does tool migrate links (external)      
Does tool migrate notes      
Does tool support delta/incremental migrations      
Does tool support batch processing      
       
Reporting      
Does the tool have pre-migration reports      
Does the tool have post-migration reports      
Does the tool have additional reports      

 

SharePoint Farm Preparation Considerations

To ensure all eRoom content successfully migrates, the following are suggested configurations on the SharePoint side that should be done prior to the start of any migration:

  • Do not block any of the document types that reside in eRoom. This may be an option if the business requires ALL content to be migrated from eRoom to SharePoint. This can be configured under Central Administration > Operations > Blocked File Types
  • Do not set default quota templates for the web application that will contain the migrated content OR you can specify a large default quota template. Default quota templates can be configured under Central Administration > Application Management > Web Application General Settings. This setting can also be temporary to ensure that all content is successfully migrated. Once content is migrated, administrators can set quota templates on the new SharePoint sites containing migrated eRoom content
  • Select a single Web Front End server in the SharePoint farm for the migration tool to use to execute the eRoom migrations. You may limit end-user access to this WFE to minimize impact on end-user experience
  • The migration tool may require intermediate storage space to execute migrations. Administrators must ensure there is enough storage to do the migrations
  • You may still want to implement the maximum number of site collections per database based on policies that have been set. This can save you the work of having to move site collections from database to database after migrations are done 
eRoom farm preparation considerations

You may want to consider the following tasks on the eRoom side to improve migration experience:

  • It is highly recommended that administrators inventory all eRooms prior to the start of any migrations and decide what eRooms are still considered active. Consider what is still needed and what is not needed
  • For eRooms being migrated, IF POSSIBLE AND PRACTICAL, owners can move all databases, projects, calendars, and contact list to the root level of the eRoom. This can speed up the migration process
  • One option would be to group documents that are targeted to specific users/groups in separate root-level folders. These folders will translate to security specific document libraries
  • Select a single Web Front End server in the eRoom farm for the migration tool to use to execute the eRoom migrations. You may limit end-user access to this WFE to minimize impact on end-user experience
End-user Communications

Proper communications before, during and after migrations can mean a big difference in the number of support calls you get from the end users and in turn a difference between good user experience and a bad user experience. Support incidents from users can be related to issues that occurred because of a migration or just simple questions that could have been answered in well crafted emails or documents.

The following may be content you should have in communications sent out to your users by way of emails or even a web site such as a wiki Q&A site:

Initial and subsequent emails

The emails contain text to eRoom users who will have their eRooms migrated describing the overview of the migration project:

  • Timeframe of the project
  • The content is going to the new SharePoint site (http://url…)
  • A statement to the users that eRooms will not be created any longer
  • State that inactive eRooms will be archived
  • References to training options
  • References to support options
  • Specify an email account to send questions and concerns to
  • Specify there will be additional communications on migration schedules for specific eRooms

Post Migration Considerations

To improve user experience, ISAPI filters or proxy servers can be used to automatically redirect users to their new SharePoint site when they attempted to access their old eRoom site. The redirection should be done after Validation and Acceptance of the migration.

Conclusion

The finer details of this approach will vary from organization to organization and what I described above is much easier said than done. Other tasks I haven’t covered would include development of a good project plan, process and workflow diagrams, escalation procedures, post migration checklists, SLAs, etc.  Because migrations like these can be very complicated and time consuming, organizations will usually find themselves engaging with consulting services who specialize in eRoom to SharePoint migrations.

A special thanks goes to fellow consultants who have made major contributions to this article: Cathy LeDuc, Jie Lee, Joe Simon, Chris Wilper.

 

Technorati Tags: ,