Officially @ the end of my rope: DB_SEC_E_AUTH_FAILED(0x80040E4D), ProcessHost, and sdata

[elliotrodriguez]

I have been trying for several days now to get Process Orchestration and sdata feeds configured. And for these several days I've gotten the same error:

No error message available, result code: DB_SEC_E_AUTH_FAILED(0x80040E4D).

Here is the stack:

OleDbException (0x80040e4d): No error message available, result code: DB_SEC_E_AUTH_FAILED(0x80040E4D).] System.Data.OleDb.OleDbConnectionInternal..ctor(OleDbConnectionString constr, OleDbConnection connection) +968297 System.Data.OleDb.OleDbConnectionFactory.CreateConnection(DbConnectionOptions options, Object poolGroupProviderInfo, DbConnectionPool pool, DbConnection owningObject) +86 System.Data.ProviderBase.DbConnectionFactory.CreateNonPooledConnection(DbConnection owningConnection, DbConnectionPoolGroup poolGroup) +29 System.Data.ProviderBase.DbConnectionFactory.GetConnection(DbConnection owningConnection) +4861516 System.Data.ProviderBase.DbConnectionClosed.OpenConnection(DbConnection outerConnection, DbConnectionFactory connectionFactory) +117 System.Data.OleDb.OleDbConnection.Open() +40 Sage.Platform.Data.DataServiceConnectionProvider.GetConnection() +188 NHibernate.Tool.hbm2ddl.SuppliedConnectionProviderConnectionHelper.Prepare() +15 NHibernate.Tool.hbm2ddl.SchemaMetadataUpdater.GetReservedWords(Dialect dialect, IConnectionHelper connectionHelper) +65 NHibernate.Tool.hbm2ddl.SchemaMetadataUpdater.Update(ISessionFactory sessionFactory) +80 NHibernate.Impl.SessionFactoryImpl..ctor(Configuration cfg, IMapping mapping, Settings settings, EventListeners listeners) +599 NHibernate.Cfg.Configuration.BuildSessionFactory() +87 Sage.Platform.Framework.SessionFactoryHolder.GetSessionFactory() +85 Sage.Platform.Framework.SessionFactoryHolder.CreateScopeSession() +26 Sage.Platform.Framework.SessionFactoryHolder.CreateSession() +32 Sage.Platform.Orm.SessionScopeWrapper..ctor(Boolean createNewScope) +81 Sage.Platform.Orm.SessionScopeWrapper..ctor() +7 Sage.SalesLogix.Web.SLXWebAuthentication.GetUserInformation(HttpApplication application, String userName, UserInformation& information) +268 Sage.SalesLogix.Web.SLXWebDigestAuthenticationModule.GetUserInformation(HttpApplication application, String userName, UserInformation& information) +21 Sage.Integration.Web.BaseAuthenticationModule.OnAuthenticateRequest(Object sender, EventArgs e) +242 System.Web.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() +68 System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously) +75

A few things:

1) Yes, I've configured my SLX admin user to the domain webdll account.

2) Yes, I am seeing the Sales Logix Client login challenge window. It's as soon as I enter credentials that the error is thrown.

3) Yes, I have added the domain webdll account to the Permissions list for each of the applications (both ProcessHost and sdata)

4) Yes, I have done a full Core Portals deployment.

5) Yes, I've run the SETSPN tool as a domain admin with AD modification rights. Here is the output (a few of these are misspellings and misapplied settings, disregard):

 http/slxwebdev2.its.local
 http://slxwebdev2
 http://slxwebdev2.its.local
 http/slxwebdev2:3334/SlxClinet
 http/slxwebdev2
 http/slxwebdev2:3334

6) Yes, SLXClient is accessible as normal.

7) Yes, both ProcessHost and sData are set UNCHECKED Integrated Windows Authentication.

8) Yes, the DBEventing service, System Service, and Server are all running normally under the WebDLL account.

I even put together a video with all the settings that I applied and sent it to Jason Huber, who confirmed that at the outset at least, everything looks ok.

But still, this does not work. This error is constantly thrown along with the one I displayed (this from Event Viewer - source is SalesLogix Process Host):

Sage.Platform.Data.DataServiceConnectionProvider - Connection Exception: No error message available, result code: DB_SEC_E_AUTH_FAILED(0x80040E4D).

The only difference I can think of is that it has something to do with our usage of Oracle instead of SQL Server.

What else is left that I've missed? Anyone?

[ahoekstra]

I've run into this and wanted to throw the desk over a number of times.. you're not alone.

Usually it turns out to be something silly.. One thing that I hadn't realized is that the IIS App Pool user has to be the SAME DLL user as the one defined as the Admin's NT Authentication user. Check to make sure those match.

[elliotrodriguez]

"One thing that I hadn't realized is that the IIS App Pool user has to be the SAME DLL user as the one defined as the Admin's NT Authentication user."

I'm not sure I follow you. We only have 1 WebDLL user on the domain.

[elliotrodriguez]

Here's what else I know.

After working with our Oracle DBA we've determined that the WebDLL user is attempting to make this query:

SELECT USERINFO.userID , userpw , usersecurity.type , adminrole
FROM sysdba.USERINFO , usersecurity
WHERE ((userinfo.userid = usersecurity.userid)) AND (UPPER(usercode) = UPPER(:1))

And the result coming back looks fine - it's after this that it crashes.

[ahoekstra]

Well the reason I mention this is because I don't see you made note of your app pool in your original post. What user is in your App Pool's Identity tab?

[elliotrodriguez]

ah - it's the same user. The only strange thing I noticed is that the services were running as:

WebDLL@mydomain.domain

versus

mydomain/WebDLL

I made these all consistent, hoping that was it, but no dice.

[ahoekstra]

On the SData virtual directory - Directory Security tab, Authentication Methods dialog.... you have all the bottom boxes unchecked? Allow anonymous access is turned on and set to the webdlluser?

Have you verified your admin's NT user is set as DOMAIN\WebDLLUser? (should be backslash, not forward)

[elliotrodriguez]

Yes to all your questions. The forward slash above was a typo using Quick Reply.

[ahoekstra]

A couple other things to check..

Be sure your SData virtual directory app pool is actually set to Saleslogix.

Make sure the "Use NT Authentication" is actually checked for the Admin user (sometimes it likes to unckeck itself)

I'm looking at my local security policy.. here are the things my WebDLL user has permissions for (on a working system).. make sure yours match up..

- Access this computer from the network
- Act as part of the operating system
- Allow log on locally
- Log on as a service

[elliotrodriguez]

I've seen conflicting documentation on the "Import Active Directory" option when adding WebDLL to Admin. On a couple of the videos it is suggested to do the import. On at least one that I've seen, we're told not to.

I ask because I did manage to get a working installation on my Vista machine (and if this can work on Vista, this should work just about anywhere). One thing I noticed is that I cannot import this information, because for some strange reason, the Department field changes from "None" to completely empty when the information is imported.

When I attempt to save, I get an exception thrown by the Administrator that indicates the validator is trying to fire on the Department field, but since it's disabled it cannot complete the operation.

This doesn't happen on my Vista machine. It keeps the "None" there.