Another weird RTC problem finding files

davmac1

I have a program that uses FILE to read a directory and search for PDF files.
It works in the dev environment which has a single server hosting SQL Server, Application tier and NAV Classic and RTC clients where the directory and files I am processing is using a UNC pathname (\\servername\dirname).
It works in the 3 server environment on CLassic. On RTC it only works if the files are on the C drive of the app server.
The app servers for both dev (1 server) and production (3 servers) are both using the same Windows user ID and they were both set to read from the same UNC name.
Is there any reason that the app server in a 3 tier would have problems finding files in a UNC directory?

kine

Are you sure that the logged in user have rights to access the path? The service tier is working under the user account I assume..

davmac1

I have logged in with the ID we are using for the service, and that user has full access to the path.

AlexanderHouzet

I had the same problem, you need to set up delegation.

http://msdn.microsoft.com/en-us/library/dd568720.aspx
http://blogs.msdn.com/b/nav/archive/2009/06/15/what-do-spns-actually-do-nav-2009.aspx
http://blogs.msdn.com/b/nav_developer/archive/2009/08/17/troubleshooting-multi-machine-installations-of-nav-2009.aspx
http://msdn.microsoft.com/en-us/library/ee414212.aspx

davmac1

We set up delegation and even had Microsoft support (Navision) go through all the setup and still have the problem.
My workaround for now is to run it through a Classic Report (processing) which invokes the Classic executable and then break the report after I have found and processed the files.
I still have an open incident with partnersource.

AlexanderHouzet

Did you set AllowNtlm to false in the config to make sure the user is authenticated properly using kerberos in stead of ntlm? And do you use the 'FullyQualifiedDomainNameOfServer' to connect the rtc?

davmac1

I tried setting AllowNtlm to false and the client would not connect.
Does that mean the client is not using kerberos?
I don't have full admin access to all the servers, so I am having to rely on the infrasture people to have the correct settings.

AlexanderHouzet

It means that kerberos authentication fails and that ntlm was used as fallback, which means that the Navision server could not delegate the user credentials to the file server because the user was not authenticated properly.

Which user do you use to run the navision server service? It has to be a domain user who is permitted to delegate.

Register spn
To add the correct spn, run this command:
“setspn –A ServerInstance/FullyQualifiedDomainNameOfServer:7046 Domain\UserName”
I added a second spn to be able to connect to the server using only the servername:
“setspn –A ServerInstance/SeverName:7046 Domain\UserName”

If you remove the Navision server, remove the spn’s:
“setspn –D ServerInstance/FullyQualifiedDomainNameOfServer:7046 Domain\UserName”
“setspn –D ServerInstance/ServerName:7046 Domain\UserName”

Allow user to delegate
To allow your user to delegate, go to the properties of the user in active directory sites and services. You can trust the user to delegate to specific services, but I have allowed the user to delegate to any service. You can check your spn’s by trying to add a service you want to trust: select the user which is used to run the Navision server, and your service should be available.

pdj

davmac1 wrote:

I still have an open incident with partnersource.

Did you ever get a workaround or hotfix from Microsoft?

I have tried the suggestion from http://www.msdynamics.de/viewtopic.php?f=40&p=54988 but I can't get it to work in the the R2 RTC...

davmac1

No - thanks for the reminder - I need to follow up with them