Business Notification -> Tools -> Security Problem

toor

Hey folks,

i've some installations of bn, all with the same problem. The main functionality works well. I can send mails with bn, but i can't use the security manager from the bn-managers tools menu.

Whenever i try to open the security manager, i get an error message on the client and an event log entry on the bn server (see below). And yes i used a local administrator as well as domain administrator and any other user.

The server is running win 2003 server with latest patches, sql server 2000 sp3a, bn services, navision 4.00 client and server (native db).

I can reproduce the problem with nav 4.00 and 4.01.

I've opened a call at mbs support, but they can't help me since 6 weeks now. The call is now at the bn developers, but they are not very cooperative.

I think that the error comes from one of the WebServices, where they try to retrieve the usernames from AD and forget to handle an unexpected result...

Hope that anybody here has an idea.

Thanks
tobi


The event log entry is:
Ereignistyp: Fehler
Ereignisquelle: DeploymentServer
Ereigniskategorie: Keine
Ereigniskennung: 0
Datum: 27.09.2005
Zeit: 16:09:46
Benutzer: Nicht zutreffend
Computer: NAV01
Beschreibung:
Exception occured while retrieving server ACL!
Exception:
System.Security.SecurityException
Exception occured while retrieving ACL!
at Microsoft.BusinessSolutions.BusinessNotification.Deployment.Server.SecurityManager.GetAcls()
at Microsoft.BusinessSolutions.BusinessNotification.Deployment.Server.DeploymentServerService.GetServerAcl()

---

Inner Exception

---

System.Runtime.InteropServices.COMException
Zuordnungen von Kontennamen und Sicherheitskennungen wurden nicht durchgeführt.
at System.Runtime.InteropServices.Marshal.ThrowExceptionForHR(Int32 errorCode, IntPtr errorInfo)
at Microsoft.Win32.Security.Sid.LookupSid(String userName, String machineName)
at Microsoft.Win32.Security.Sid..ctor(String userName)
at Microsoft.BusinessSolutions.BusinessNotification.Deployment.Server.SecurityManager.GetAcls()


Weitere Informationen über die Hilfe- und Supportdienste erhalten Sie unter http://go.microsoft.com/fwlink/events.asp.

kine

May be that you have some "problem" with AD.

1) Be sure, that there are not problems with some old DNS entries (leading to non-existing IP, old names for same IPs etc.)

2) You can "trace" the network flow for example with Ethereal to know, what the BN is doing in time of problems (asking for AD server, searching for his name, communicating with AD etc...) - but you need to understand TCP/IP a little...

3) Can you read virtual table 2000000050 without problems within Navision? If no, there is problem with AD. Sometime restarting the server helps ;-)

No more hints for you now...

toor

hi kine,

thanks for your replay.

There is only one dns entry for the DC. The system is running in a VPC enviroment. No reverse lookup zone is defined for my cronus.local-Domain. Nslookup works fine for forward lookups.

I can read the table 2000000050 without problems, logged in with the BN Service Account.

I will try to sniff the network flow later.


so, thanks again
tobias

kine

One thing more:

May be there is problem with some ACL for non-existing account. Please, check exposed areas for UIDs for deleted users (UID which cannot be translated to login name, because the account was deleted) - look into file permissions, IIS permissions, etc.

But this is only a tip.

toor

hi kine,

thanks again.

I can't sniff the network traffic because i've installed all components on a single (virtual) machine. So there is nothing that Eterreal can sniff from the network card :-(

Are there any tools to sniff from the tcp/ip-driver of the os?

I've checked for non-existing accounts in the past, but without success. It's a clean installation and i never deleted any users. I've also checked and played arround with the iis permissions. No succes, as well.

Do you know some tools, that check the AD for consistency/functionalty? But i don't think that the AD is really damaged, because everything else works pretty fine. No entries in the eventvwr and no unexpected behavior.


I have the problem also at a customers installation. So i'm wondering to be the first guy reporting this problem. Or have someone heard something about this?

greetings
tobias