Access denied against DP for untrusted clients

Hi,
I have an SCCM 2012 R2 environment.
There are a few clients in an untrusted domain behind a firewall.
DP's and MP's are not configured for SSL. The following ports have been opened to the MP and DP's.
TCP 80
TCP 10123
TCP 2710
DNS or AD for the untrusted servers have not been extended with SCCM data.
Clients were installed on the untrusted servers using the SMSMP switch.
After installation the clients appeared in SCCM and were manually approved.
Boundaries exist for the lcients associated with the correct boundary group for site system assignment
Since installation the clients have successfully discovered MP's, DP's and performed inventories
There is however a problem with software deployment.
The clients try to download content as expected from the correct DP's however the log files show 80070005 therefore access denied.
There is anetwork access account configured for the site which definatley works because we have no OSD issues.
Am I right in thinking that these untrusted clients should revert to using the network access account when they get an access denied ?
If so what may prevent them from doing this
Thanks,
Jim

Hi Jason,
The clients are running server 2012 R2
Here are some log snippets with server names and site codes editied.
CAS.LOG
Location update from CTM for content xxx00043.2 and request {D6BA950D-1DB5-4FDE-8B61-C73A3D4A96A6} ContentAccess 11/01/2015 02:06:57 5392 (0x1510)
Download location found 0 - http://server1/SMS_DP_SMSPKG$/xxx00043 ContentAccess 11/01/2015 02:06:57 5392 (0x1510)
Download location found 1 - http://server2/SMS_DP_SMSPKG$/xxx00043 ContentAccess 11/01/2015 02:06:57 5392 (0x1510)
Download location found 2 - http://server3/SMS_DP_SMSPKG$/xxx00043 ContentAccess 11/01/2015 02:06:57 5392 (0x1510)
Download request only, ignoring location update ContentAccess 11/01/2015 02:06:57 5392 (0x1510)
Download started for content xxx00043.2 ContentAccess 11/01/2015 02:06:57 3872 (0x0F20)
Download failed for content xxx00043.2 under context System, error 0x80070005 ContentAccess 11/01/2015 02:06:58 5392 (0x1510)
Download failed for download request {D6BA950D-1DB5-4FDE-8B61-C73A3D4A96A6} ContentAccess 11/01/2015 02:06:58 5392 (0x1510)
Raising event:
[SMS_CodePage(850), SMS_LocaleID(2057)]
instance of SoftDistDownloadFailedEvent
ClientID = "GUID:820D9280-13A5-4295-9250-CF675073FF35";
DateTime = "20150111020658.235000+000";
MachineName = "client";
PackageId = "xxx00043";
PackageName = "xxx00043";
PackageVersion = "2";
ProcessID = 4188;
SiteCode = "S01";
ThreadID = 5392;
ContentAccess 11/01/2015 02:06:58 5392 (0x1510)
Successfully raised Download Failed event. ContentAccess 11/01/2015 02:06:58 5392 (0x1510)
ContentTransferManager.log
Starting CTM job {369AA46C-CF9F-4DD2-AE50-45874D28F571}. ContentTransferManager 11/01/2015 06:06:58 6528 (0x1980)
Created CTM job {369AA46C-CF9F-4DD2-AE50-45874D28F571} for user S-1-5-18 ContentTransferManager 11/01/2015 06:06:58 6528 (0x1980)
Created and Sent Location Request '{0D80A8A2-2E69-47E6-9E22-419F6612DB85}' for package xxx00043 ContentTransferManager 11/01/2015 06:06:58 4672 (0x1240)
CTM job {369AA46C-CF9F-4DD2-AE50-45874D28F571} entered phase CCM_DOWNLOADSTATUS_DOWNLOADING_DATA ContentTransferManager 11/01/2015 06:06:58 4672 (0x1240)
Queued location request '{0D80A8A2-2E69-47E6-9E22-419F6612DB85}' for CTM job '{369AA46C-CF9F-4DD2-AE50-45874D28F571}'. ContentTransferManager 11/01/2015 06:06:58 4672 (0x1240)
Persisted locations for CTM job {369AA46C-CF9F-4DD2-AE50-45874D28F571}:
(LOCAL) http://server1/SMS_DP_SMSPKG$/xxx00043
(LOCAL) http://server2/SMS_DP_SMSPKG$/xxx00043
(LOCAL) http://server3/SMS_DP_SMSPKG$/xxx00043 ContentTransferManager 11/01/2015 06:06:58 6132 (0x17F4)
CTM job {369AA46C-CF9F-4DD2-AE50-45874D28F571} (corresponding DTS job {4E1EF8CA-6985-4D42-99F0-3107B7589CA6}) started download from 'http://server1/SMS_DP_SMSPKG$/xxx00043' for full content download. ContentTransferManager 11/01/2015 06:06:58 6132
(0x17F4)
CTM job {369AA46C-CF9F-4DD2-AE50-45874D28F571} entered phase CCM_DOWNLOADSTATUS_DOWNLOADING_DATA ContentTransferManager 11/01/2015 06:06:59 3204 (0x0C84)
CTM job {369AA46C-CF9F-4DD2-AE50-45874D28F571} switched to location 'http://server2/SMS_DP_SMSPKG$/xxx00043' ContentTransferManager 11/01/2015 06:06:59 3204 (0x0C84)
CTM job {369AA46C-CF9F-4DD2-AE50-45874D28F571} entered phase CCM_DOWNLOADSTATUS_DOWNLOADING_DATA ContentTransferManager 11/01/2015 06:06:59 6528 (0x1980)
CTM job {369AA46C-CF9F-4DD2-AE50-45874D28F571} switched to location 'http://server3/SMS_DP_SMSPKG$/xxx00043' ContentTransferManager 11/01/2015 06:06:59 4672 (0x1240)
CTM job {369AA46C-CF9F-4DD2-AE50-45874D28F571} entered phase CCM_DOWNLOADSTATUS_DOWNLOADING_DATA ContentTransferManager 11/01/2015 06:06:59 304 (0x0130)
CTM job {369AA46C-CF9F-4DD2-AE50-45874D28F571} encountered error 0x80070005 during download ('Error processing manifest.')- The error maps to denied access. ContentTransferManager 11/01/2015 06:06:59 6528 (0x1980)
Let me know if any other specific log files will give more clues
Thanks,
Jim

Similar Messages

Access denied when trying to connect client cd rom to vm

Hey guys,
One of my users is using the client to build a vm, tries to connect their cdrom using the client and gets access denied. What is the minimum permissions needed to be able to connect a remote physical cd rom to a vm? VC 2.5, esx 3.0, I believe they currently have virtual machine power user role on the object.
Respectfully,
Matthew
Kaizen!

Hey Guys,
I think there is something else going on here Probably not permissions or roles, maybe a service needs restarting? The user gets the following error:
Exception of type Vmomi.fault.no permission' was thrown
Ideas?
Respectfully,
Matthew
Kaizen!

Access denied error in a popup for most of the clients.

Hi all,
 i implemented the search help in a popup. its working well in some clients and in some clients it's not .
 here clients means not different browsers different workstations.
 the problem is .
 from the popup i am setting the opener field value.
the code is as follows.
 parent.document.getElementById("XXXXX").value ="XY";
 here i am getting the Access denied error on some clients and some clients the value is getting set.
 how could i overcome this problem,
Regards,
shiva.

Hi
 i tried how was it in the thread mentioned in the above reply, but not getting it .
but what i noticed is
 if my server domain is like ABC.COM it's working .
 if the server domain is like ABC.XXX.COM then it's not working
Any suggestions will be appreciated.
Regards
shiva.

Cannot use Offline Files with DFS share: "Access denied" error for DfsrPrivate in Sync Center

Hello,
I have an infrastructure that uses DFS to move files to different sites and we are using a GPO to define Offline Files for users at those sites. Whenever we try to initiate a manual sync, an error stating "Access
denied" is generated for all DfsrPrivate directories and the Sync Center reports it as a failed sync. We have tried giving Domain Users, Everyone, and invidiual accounts Write, Modify and even Full Control permissions to the DfsrPrivate directories and
as it seems, only users with administrative access and allowed to sync properly. Is there something obvious I'm missing here?
-Girard

Hi,
I cannot help test on this moment but we should not create offline files on DfsrPrivate folders which will cause issue. Try to exclude those folders as Offline Files and it should work in Sync Center.
If you have any feedback on our support, please send to [email protected]

Receiver File Adapter - FTPEx: 550 Access denied

Hi Experts,
In my receiver file adapter scenario I'm getting 550 Access denied in RWB.
I am a little confused here because I could access the FTP client from my desktop using the same User and Password informed in the Receiver CC. I also could drag and drop a file there.
Here you have Detail Display in RWB, it seems that at least the user is working fine for PI also:
Success: Connecting to FTP server "<FTP IP>"
Success: Write to FTP server "192.168.10.85", directory "\Transportadoras\10326750000101\", file "Nfe_teste.xml"
Success: Transfer: "TXT" mode, size 8881 bytes, character encoding UTF-8
Error: Attempt to process file failed with An error occurred while connecting to the FTP server '192.168.10.85:21'. The FTP server returned the following error message: 'com.sap.aii.adapter.file.ftp.FTPEx: 550 Access denied.'. For details, contact your FTP server vendor.
Error MP: Exception caught with cause com.sap.aii.af.ra.ms.api.RecoverableException: An error occurred while connecting to the FTP server '192.168.10.85:21'. The FTP server returned the following error message: 'com.sap.aii.adapter.file.ftp.FTPEx: 550 Access denied.'. For details, contact your FTP server vendor.
Regards,
Daniela
Edited by: Daniela Machado on Aug 11, 2010 10:18 PM

Hi Daneial,
This is an issue due to any firewall or proxy between your Xi system and the FTP.In this case the direct logon
works with same user but when XI tries to create file at runtime you get this error due to network issues.
To resolve this contact your Basis/Network guys and
1. Set the permissions to FTP User you are using as 777 rights(full access to read , write and delete)
2.If you have access to PI server, try to telnet /connect to ftp using command prompt (open ftp .....) the FTP server form there, you should see the same error there , inform this to your network guys.
3.Clear all the files places already in the ftp (take backup) and test afresh after permissions are set by basis team.
Regards,
$rinivas

Inconsistent "access denied" on publish

I am at wits end. Am working on a project that involves some editing of one area on client's internal website. Used Contribute just fine for this last year. Now...
When I try to Publish certain pages, I get the "Access denied. Page may not exist or there may be a permission problem." That is, this problem had existed on only SOME pages. Now, I can't publish on any of them.
The permissions are set correctly for me to publish.
No-one else has pages open. (Nobody in the organization knows how to use C anyway.)
I would gladly pay someone to help with this. Hope someone can help.

Was El Sobrante... Had to create a new user ID, etc. because could not log into account. Many cuss-words leap to mind at this point.
No, the thread did not help. I had inconsistent "access denied" on publish for version 3 before I downloaded the trial new version. Same problem on version 5. Now I can't publish at all on any pages AND when I open version 3 it says the version is too old. Thought I'd uninstall 5 but it's the only version showing up. Can't imagine what's going to happen when the trial runs out.
Anyway. Still need to fix the original problem.

Access denied to external Hard Drive on Windows 7?

Hey,
Thanks in Advance for your help. Yesterday I downloaded and installed Windows 7 (which looks like its going to be a massive improvement on Vista!!). Though I had a problem when I tried to open my external Hard drive (which is an Internal hard drive in an enclosure ":H"). An error message pops up every time I double click it saying that access to this drive is denied.
This used to happen when I would change from PC to PC but was able to fix it using instructions from this Link http://www.le.ac.uk/cc/dsss/docs/acls2.shtml
Any help would be much appreciated.
Regards
Jordan

Folks,
I faced a similar problem when trying to move a NTFS formatted disk from XP to windows 7. I tried suggestions on various forums but nothing worked. Finally though, i was able to identify the root cause empirically and fix it.
1. In my understanding, Windows 7 interprets the permissions on a NTFS drive very strictly. Hence while a NTFS HDD with tweaked security settings - say with only administrator access/ownership under security tab may work perfectly in XP, OS X, Ubuntu etc
, Win 7 will show you access denied unless permissions for ALL of the following: AuthenticatedUsers, SYSTEM, Administrator & Users is set correctly (which is default for a newly formatted drive in windows)
2. You can do this either manually by adding these one by one or by simply formatting the drive (this however is destructive for data).
3. I therefore simply set the permissions correctly AFTER taking ownership of the drive and I was able to access the drive just fine.
4. To prove that its merely a permission issue where Windows 7 is arguabily behaving correctly, before making any permission changes, try booting your computer in Safe Mode and you should be able to access your data just fine while you are in the Safe Mode.
5. Lesson for me was to be very careful with NTFS permissions, especially while removing those present by default.
6. I managed to solve the issue before seeing this thread. Hence i do not know if "foreign drive" solution below would have worked in my case.
To Microsoft: This solution should be WAY more easier to find on the net. Hell, its shouldn't even be a be a problem! Windows should be able to reset the permissions to default with a single click on a non encrypted NTFS drive if the person trying to do this
has the administrator access.
Hope this allows people to save time and data.
Cheers!

Access denied to Citrix using Safari (error code 7)

I have previously been able to access my Citrix work server from home using Safari. This is no longer possible following update to 10.4.9. When attempting access I get the following message:
"A local security certificate could not be loaded (error code 7)".
From the web it appears that other Mac users have also encountered this problem with Citrix. A Citrix administrators' site suggests reseting Java in preferences to an earlier version. I'm not clear how to do this and from previous experience changing things in Java setups is a bad idea.
Has anyone found a practicable solution?

Folks,
I faced a similar problem when trying to move a NTFS formatted disk from XP to windows 7. I tried suggestions on various forums but nothing worked. Finally though, i was able to identify the root cause empirically and fix it.
1. In my understanding, Windows 7 interprets the permissions on a NTFS drive very strictly. Hence while a NTFS HDD with tweaked security settings - say with only administrator access/ownership under security tab may work perfectly in XP, OS X, Ubuntu etc
, Win 7 will show you access denied unless permissions for ALL of the following: AuthenticatedUsers, SYSTEM, Administrator & Users is set correctly (which is default for a newly formatted drive in windows)
2. You can do this either manually by adding these one by one or by simply formatting the drive (this however is destructive for data).
3. I therefore simply set the permissions correctly AFTER taking ownership of the drive and I was able to access the drive just fine.
4. To prove that its merely a permission issue where Windows 7 is arguabily behaving correctly, before making any permission changes, try booting your computer in Safe Mode and you should be able to access your data just fine while you are in the Safe Mode.
5. Lesson for me was to be very careful with NTFS permissions, especially while removing those present by default.
6. I managed to solve the issue before seeing this thread. Hence i do not know if "foreign drive" solution below would have worked in my case.
To Microsoft: This solution should be WAY more easier to find on the net. Hell, its shouldn't even be a be a problem! Windows should be able to reset the permissions to default with a single click on a non encrypted NTFS drive if the person trying to do this
has the administrator access.
Hope this allows people to save time and data.
Cheers!

Internet Explorer 11 silent uninstall - Access Denied

Hey,
We are trying to uninstall IE11 on some devices via SCCM.
Unfortunately our command line:
FORFILES /P %WINDIR%\servicing\Packages /M Microsoft-Windows-InternetExplorer-*11.*.mum /c "cmd /c echo Uninstalling package @fname && start /w pkgmgr /up:@fname /norestart"
Returns "Access Denied" with a popup window...even running as system account with PSexec.exe
Of course our users cannot see the popup window during deployment by SCCM and installation runs into timeout.
If I run the command line manually via and select 'OK' at the popups the uninstallation goes on and works after restart.
How is the recommended way by Microsoft of uninstalling IE11?
Thank you.
Kind Regards

Hi Torsten,
thank you for your help.
The access denied happens always for the two red marked files.
If there is an language pack installed there is an additional access denied.
Something more I found is that after internet explorer 11 update and restart the desktop background of each user is black.
If I restart again it is gone and user sees his desktop background again.
(Of course no real 'issue' but users are frustrated and are not very please of IE11 at the beginning)
Kind Regards
Martin Kraemer

Keep getting error message access denied then already a project with that

name saved.
I don't understand why this is happening now, I have done this stuff many times before and NOW I am getting this message over and over! I am trying to start a new project and I keep getting that message. (it also says there is already a project using that name that I am trying to save it as. I have tried rebooting and shutting down FCE to no avail. I can't render anything because I guess I am NOT allowed access to my own project. Does anyone know how to resolve this? I have an external drive that my scratch settings are set to. They are still there and the message is STILL bouncing up.
Thanks in advance
ruez

The other error message reads "there is already a project with that name", when I try to save it. Then it saves it as a copy, then the next time it is saved as a copy copy. I don't get it! I am doing just what I have always done and now this?
When you say 'drives' what are you referring to exactly? How would I trash my preferences? Where would I check permission on my drives?
Thanks Tom, as I am sitting here that little FCE icon is flashing me already to tell me Autosave: A file of this name already exists. When I click ok, Autosave comes back with access denied.
Thanks for all your help!!
ruez

Access denied report App\Client SDK

Server crashed, therefore I reinstalled Crystal Reports 9 & Crystal Enterprise 9 and attempting to rebuild the ASP pages which pass report parameters. The error received is:
Technical Information (for support personnel)
Error Type:
webReporting.dll (0x80004005)
Access denied. Please check directory setting for files you can access.
/HTMLViewers/reportgenerator.asp, line 31
Browser Type:
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 2.0.50727)
Page:
GET /HTMLViewers/reportgenerator.asp
Line 31 on the page reads:
.processHttpRequest Request, Response, Session
Running the registry moniter I receive an access Denied for hklm\software\Crystal Decisions\9.0\report App\client SDK
This is my first time on the forum, hope I explained myself properly.

Thanks Shaun, I appreciate your link for the process monitor application. This replaces my older seperate reg mon & file mon apps.
I have now been able to determine that my application is getting to where it is calling the cachemanager.dll and it is experiencing the problem. I tried manually registering this dll and receive the error Loadlibrary("cachemanager.dll")failed. GetLastError Returns 0x00000007e.
If I change the ASP pages to a very simple process, it will run the demo report, and my report. Once I attempt to use the ASP page with the login requesst, and parameter call I receive this error.
Error Type:
webReporting.dll (0x80004005)
The system cannot find the path specified.
/HTMLViewers/reportgenerator.asp, line 31
Browser Type:
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 2.0.50727)
Page:
GET /HTMLViewers/reportgenerator.asp
The reportgenerator ASP page which is causing this error is:
trace.write(category,message)
trace.warn(category,message)
<%@ Language="VBScript"%>
<%
'Declare variables for the report viewer and the ObjectFactory objects, and create the ObjectFactory object.
Dim ObjectFactory, userName, password
dim clientid
dim reportid
clientid = request.querystring("Clientid")
session("Clientid") = clientid
reportid = request.querystring("reportid")
' open a report
' copy this report to "Report Directory" in RAS Configuration Manager
Session("ReportName") = "C:\Program Files\Crystal Decisions\Report Application Server 9\Reports\logonparm\" & reportid
userName = "SYSDBA"
password = "masterkey"
'Create the ObjectFactory for use in creating other Crystal Objects
Set ObjectFactory=CreateObject("CrystalReports.ObjectFactory.2")
'Instantiate the Server Control object which allows us to collect information about the required
'inputs to run the report
Set ServerControl = ObjectFactory.CreateObject("CrystalReports.CrystalReportServerControl")
With ServerControl
 .ReportSource = Session("ReportName")
 .EnableLogonPrompt = False ' Set this to false so that we can override the controls prompting for logon
 .processHttpRequest Request, Response, Session
End With
Set Session("ReportParameters") = ServerControl.ParameterFields
' Set Login info for all connections
' ***************** Added to logon using Viewer SDK *****************************
Set connectionInfos = serverControl.databaseLogonInfos
For x=0 To connectionInfos.count - 1
 Set connInfo = connectionInfos.Item(x)
 connInfo.UserName = CStr(username)
 connInfo.Password = CStr(password)
Next
For each parameter in Session("ReportParameters")
 Set parameterField = parameter
 paramName = parameterField.Name
 if paramName = "INTERFACE ID" then
 Dim paramValue
 Set paramValue = ObjectFactory.CreateObject("CrystalReports.ParameterFieldDiscreteValue")
 paramValue.Value = session("Clientid")
 parameterField.CurrentValues.RemoveAll
 ' Add this value to current value list
 parameterField.CurrentValues.Add paramValue
 end if
Next
Set clientDoc = CreateObject("CrystalClientDoc.ReportClientDocument")
clientDoc.Open session("ReportName")
set session("oclientdoc")=clientdoc
Session("pathReport") = pathReport
Set Session("connectionInfos") = connectionInfos
Response.Redirect "Viewer.asp"
%>
My appologies if I do not explain my problem well. I am not an ASP programmer, and am desperatly looking for assistance to resolve this problem. If anyone can refer a contract programmer that would be interested and capable of assisting me, that would be appreciated. I believe I am close to resolving this problem. I purchased a support session only to find out that this version is no longer supported.

Access denied error for BW Report iView..Please help :(

Hello All,
I have created a BW Report iView..containing a Bex query.
Have created the required BW system object too.
When I preview this iView, it asks me for BW system authentication....since am not mapped to this BW system.
Its alright till here......
Problem:
Now, when I copy paste the URL (URL generated when you preview this iView) into a new browser window, I get an error saying:
" An exception occurred while processing a request for :
iView : N/A
Component Name : N/A
Access denied (Object(s): <iView path>
Exception id: 02:57_13/02/06_0034_6204550
See the details for the exception ID in the log file "
I checked tha bove mentioned log and it says:
Permission check failed - Object <iView path> Pcd.Use Principal: Information not available with current trace level#
Changed the iView authentication scheme to every value present but it did not resolve.
Please help me resolve this.
Awaiting Reply.
Thanks and Warm Regards
Ritu

Hi Raja,
Firstly thanks for a quick response.
I did as per you suggested but it isnt working. Am getting the same error again.
Please refer to the log details below:
1.5#000F206F053800610000008100000A1000040CAA10AF2627#1139824470727#com.sap.portal.pcd.Gl.Admin#sap.com/irj#com.sap.portal.pcd.Gl.Admin#Guest#0##sapnw2_J2E_6204550#Guest#63f4e0f093d911da8b7b000f206f0538#SAPEngine_Application_Thread[impl:3]_1##0#0#Warning#1#/System/Server#Plain###Permission check failed - Object portal_content/Ritu/MIDAS/CEO_redalert Permissions: Pcd.Use Principal: Information not available with current trace level#
#1.5#000F206F053800610000008300000A1000040CAA10AF2963#1139824470743#com.sap.portal.pcd.Gl.Admin#sap.com/irj#com.sap.portal.pcd.Gl.Admin#Guest#0##sapnw2_J2E_6204550#Guest#63f4e0f093d911da8b7b000f206f0538#SAPEngine_Application_Thread[impl:3]_1##0#0#Warning#1#/System/Server#Plain###Permission check failed - Object portal_content/Ritu/MIDAS/CEO_redalert Permissions: Pcd.Use Principal: Information not available with current trace level#
#1.5#000F206F053800610000008600000A1000040CAA10AF4031#1139824470743#com.sap.portal.portal#sap.com/irj#com.sap.portal.portal#Guest#0##sapnw2_J2E_6204550#Guest#63f4e0f093d911da8b7b000f206f0538#SAPEngine_Application_Thread[impl:3]_1##0#0#Error#1#/System/Server#Java###Exception ID:03:24_13/02/06_0059_6204550
[EXCEPTION]
#1#com.sapportals.portal.prt.runtime.PortalRuntimeException: Access is denied: pcd:portal_content/Ritu/MIDAS/CEO_redalert - user: Guest
 at com.sapportals.portal.prt.deployment.DeploymentManager.getPropertyContentProvider(DeploymentManager.java:1932)
 at com.sapportals.portal.prt.core.broker.PortalComponentContextItem.refresh(PortalComponentContextItem.java:230)
 at com.sapportals.portal.prt.core.broker.PortalComponentContextItem.getContext(PortalComponentContextItem.java:312)
 at com.sapportals.portal.prt.component.PortalComponentRequest.getComponentContext(PortalComponentRequest.java:385)
 at com.sapportals.portal.prt.connection.PortalRequest.getRootContext(PortalRequest.java:435)
 at com.sapportals.portal.prt.core.PortalRequestManager.runRequestCycle(PortalRequestManager.java:607)
 at com.sapportals.portal.prt.connection.ServletConnection.handleRequest(ServletConnection.java:232)
 at com.sapportals.portal.prt.dispatcher.Dispatcher$doService.run(Dispatcher.java:522)
 at java.security.AccessController.doPrivileged(Native Method)
 at com.sapportals.portal.prt.dispatcher.Dispatcher.service(Dispatcher.java:405)
 at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
 at com.sap.engine.services.servlets_jsp.server.servlet.InvokerServlet.service(InvokerServlet.java:153)
 at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
 at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.runServlet(HttpHandlerImpl.java:385)
 at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.handleRequest(HttpHandlerImpl.java:263)
 at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:340)
 at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:318)
 at com.sap.engine.services.httpserver.server.RequestAnalizer.invokeWebContainer(RequestAnalizer.java:821)
 at com.sap.engine.services.httpserver.server.RequestAnalizer.handle(RequestAnalizer.java:239)
 at com.sap.engine.services.httpserver.server.Client.handle(Client.java:92)
 at com.sap.engine.services.httpserver.server.Processor.request(Processor.java:147)
 at com.sap.engine.core.service630.context.cluster.session.ApplicationSessionMessageListener.process(ApplicationSessionMessageListener.java:37)
 at com.sap.engine.core.cluster.impl6.session.UnorderedChannel$MessageRunner.run(UnorderedChannel.java:71)
 at com.sap.engine.core.thread.impl3.ActionObject.run(ActionObject.java:37)
 at java.security.AccessController.doPrivileged(Native Method)
 at com.sap.engine.core.thread.impl3.SingleThread.execute(SingleThread.java:94)
 at com.sap.engine.core.thread.impl3.SingleThread.run(SingleThread.java:162)
Caused by: com.sapportals.portal.pcd.gl.PermissionControlException: Access denied (Object(s): portal_content/Ritu/MIDAS/CEO_redalert)
 at com.sapportals.portal.pcd.gl.PcdFilterContext.filterLookup(PcdFilterContext.java:390)
 at com.sapportals.portal.pcd.gl.PcdProxyContext.basicContextLookup(PcdProxyContext.java:1066)
 at com.sapportals.portal.pcd.gl.PcdProxyContext.basicContextLookup(PcdProxyContext.java:1072)
 at com.sapportals.portal.pcd.gl.PcdProxyContext.basicContextLookup(PcdProxyContext.java:1072)
 at com.sapportals.portal.pcd.gl.PcdProxyContext.basicContextLookup(PcdProxyContext.java:1072)
 at com.sapportals.portal.pcd.gl.PcdProxyContext.proxyLookupLink(PcdProxyContext.java:1168)
 at com.sapportals.portal.pcd.gl.PcdProxyContext.proxyLookup(PcdProxyContext.java:1115)
 at com.sapportals.portal.pcd.gl.PcdProxyContext.lookup(PcdProxyContext.java:909)
 at com.sapportals.portal.pcd.gl.PcdGlContext.lookup(PcdGlContext.java:78)
 at com.sapportals.portal.pcd.gl.PcdURLContext.lookup(PcdURLContext.java:238)
 at javax.naming.InitialContext.lookup(InitialContext.java:347)
 at com.sapportals.portal.prt.deployment.DeploymentManager.getPropertyContentProvider(DeploymentManager.java:1919)
 ... 26 more
==========================
The auth scheme of this iView is set to default
Please help me resolve this......
Awaiting Reply.
Thanks and Warm Regards,
Ritu
Message was edited by: Ritu Hunjan

AnyConnect error " User not authorized for AnyConnect Client access, contact your administrator"

Hi everyone,
it's probably just me but I have tried real hard to get a simple AnyConnect setup working in a lab environment on my ASA 5505 at home, without luck. When I connect with the AnyConnect client I get the error message "User not authorized for AnyConnect Client access, contact your administrator". I have searched for this error and tried some of the few solutions out there, but to no avail. I also updated the ASA from 8.4.4(1) to 9.1(1) and ASDM from 6.4(9) to 7.1(1) but still the same problem. The setup of the ASA is straight forward, directly connected to the Internet with a 10.0.1.0 / 24 subnet on the inside and an address pool of 10.0.2.0 / 24 to assign to the VPN clients. Please note that due to ISP restrictions, I'm using port 44455 instead of 443. I had AnyConnect working with the SSL portal, but IKEv2 IPsec is giving me a headache. I have stripped down certificate authentication which I had running before just to eliminate this as a potential cause of the issue. When running debugging, I do not get any error messages - the handshake completes successfully and the local authentication works fine as well.
Please find the current config and debugging output below. I appreciate any pointers as to what might be wrong here.
: Saved
ASA Version 9.1(1)
hostname ASA
domain-name ingo.local
enable password ... encrypted
xlate per-session deny tcp any4 any4
xlate per-session deny tcp any4 any6
xlate per-session deny tcp any6 any4
xlate per-session deny tcp any6 any6
xlate per-session deny udp any4 any4 eq domain
xlate per-session deny udp any4 any6 eq domain
xlate per-session deny udp any6 any4 eq domain
xlate per-session deny udp any6 any6 eq domain
passwd ... encrypted
names
name 10.0.1.0 LAN-10-0-1-x
dns-guard
ip local pool VPNPool 10.0.2.1-10.0.2.10 mask 255.255.255.0
interface Ethernet0/0
switchport access vlan 2
interface Ethernet0/1
interface Ethernet0/2
interface Ethernet0/3
interface Ethernet0/4
interface Ethernet0/5
interface Ethernet0/6
interface Ethernet0/7
interface Vlan1
nameif Internal
security-level 100
ip address 10.0.1.254 255.255.255.0
interface Vlan2
nameif External
security-level 0
ip address dhcp setroute
regex BlockFacebook "facebook.com"
banner login This is a monitored system. Unauthorized access is prohibited.
boot system disk0:/asa911-k8.bin
ftp mode passive
clock timezone PST -8
clock summer-time PDT recurring
dns domain-lookup Internal
dns domain-lookup External
dns server-group DefaultDNS
name-server 10.0.1.11
name-server 75.153.176.1
name-server 75.153.176.9
domain-name ingo.local
object network obj_any
subnet 0.0.0.0 0.0.0.0
object network LAN-10-0-1-x
subnet 10.0.1.0 255.255.255.0
object network Company-IP1
host xxx.xxx.xxx.xxx
object network Company-IP2
host xxx.xxx.xxx.xxx
object network HYPER-V-DUAL-IP
range 10.0.1.1 10.0.1.2
object network LAN-10-0-1-X
access-list 100 extended permit tcp any4 object HYPER-V-DUAL-IP eq 3389 inactive
access-list 100 extended permit tcp object Company-IP1 object HYPER-V-DUAL-IP eq 3389
access-list 100 extended permit tcp object Company-IP2 object HYPER-V-DUAL-IP eq 3389
tcp-map Normalizer
check-retransmission
checksum-verification
no pager
logging enable
logging timestamp
logging list Threats message 106023
logging list Threats message 106100
logging list Threats message 106015
logging list Threats message 106021
logging list Threats message 401004
logging buffered errors
logging trap Threats
logging asdm debugging
logging device-id hostname
logging host Internal 10.0.1.11 format emblem
logging ftp-bufferwrap
logging ftp-server 10.0.1.11 / asa *****
logging permit-hostdown
mtu Internal 1500
mtu External 1500
ip verify reverse-path interface Internal
ip verify reverse-path interface External
icmp unreachable rate-limit 1 burst-size 1
icmp deny any echo External
asdm image disk0:/asdm-711.bin
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
object network obj_any
nat (Internal,External) dynamic interface
object network LAN-10-0-1-x
nat (Internal,External) dynamic interface
object network HYPER-V-DUAL-IP
nat (Internal,External) static interface service tcp 3389 3389
access-group 100 in interface External
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
aaa-server radius protocol radius
aaa-server radius (Internal) host 10.0.1.11
key *****
radius-common-pw *****
user-identity default-domain LOCAL
aaa authentication ssh console radius LOCAL
http server enable
http LAN-10-0-1-x 255.255.255.0 Internal
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec ikev2 ipsec-proposal DES
protocol esp encryption des
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal 3DES
protocol esp encryption 3des
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES
protocol esp encryption aes
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES192
protocol esp encryption aes-192
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES256
protocol esp encryption aes-256
protocol esp integrity sha-1 md5
crypto ipsec security-association pmtu-aging infinite
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
crypto map External_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map External_map interface External
crypto ca trustpoint srv01_trustpoint
enrollment terminal
crl configure
crypto ca trustpoint asa_cert_trustpoint
keypair asa_cert_trustpoint
crl configure
crypto ca trustpoint LOCAL-CA-SERVER
keypair LOCAL-CA-SERVER
crl configure
crypto ca trustpool policy
crypto ca server
cdp-url http://.../+CSCOCA+/asa_ca.crl:44435
issuer-name CN=...
database path disk0:/LOCAL_CA_SERVER/
smtp from-address ...
publish-crl External 44436
crypto ca certificate chain srv01_trustpoint
certificate <output omitted>
quit
crypto ca certificate chain asa_cert_trustpoint
certificate <output omitted>
quit
crypto ca certificate chain LOCAL-CA-SERVER
certificate <output omitted>
quit
crypto ikev2 policy 1
encryption aes-256
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 10
encryption aes-192
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 20
encryption aes
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 30
encryption 3des
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 40
encryption des
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 enable External client-services port 44455
crypto ikev2 remote-access trustpoint asa_cert_trustpoint
telnet timeout 5
ssh LAN-10-0-1-x 255.255.255.0 Internal
ssh xxx.xxx.xxx.xxx 255.255.255.255 External
ssh xxx.xxx.xxx.xxx 255.255.255.255 External
ssh timeout 5
ssh version 2
console timeout 0
no vpn-addr-assign aaa
no ipv6-vpn-addr-assign aaa
no ipv6-vpn-addr-assign local
dhcpd dns 75.153.176.9 75.153.176.1
dhcpd domain ingo.local
dhcpd option 3 ip 10.0.1.254
dhcpd address 10.0.1.50-10.0.1.81 Internal
dhcpd enable Internal
threat-detection basic-threat
threat-detection scanning-threat shun except ip-address LAN-10-0-1-x 255.255.255.0
threat-detection statistics access-list
threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
dynamic-filter use-database
dynamic-filter enable interface Internal
dynamic-filter enable interface External
dynamic-filter drop blacklist interface Internal
dynamic-filter drop blacklist interface External
ntp server 128.233.3.101 source External
ntp server 128.233.3.100 source External prefer
ntp server 204.152.184.72 source External
ntp server 192.6.38.127 source External
ssl encryption aes256-sha1 aes128-sha1 3des-sha1
ssl trust-point asa_cert_trustpoint External
webvpn
port 44433
enable External
dtls port 44433
anyconnect image disk0:/anyconnect-win-3.1.02026-k9.pkg 1
anyconnect profiles profile1 disk0:/profile1.xml
anyconnect enable
smart-tunnel list SmartTunnelList1 mstsc mstsc.exe platform windows
smart-tunnel list SmartTunnelList1 putty putty.exe platform windows
group-policy DfltGrpPolicy attributes
vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec ssl-client ssl-clientless
webvpn
anyconnect profiles value profile1 type user
username write.ingo password ... encrypted
username ingo password ... encrypted privilege 15
username tom.tucker password ... encrypted
class-map TCP
match port tcp range 1 65535
class-map type regex match-any BlockFacebook
match regex BlockFacebook
class-map type inspect http match-all BlockDomains
match request header host regex class BlockFacebook
class-map inspection_default
match default-inspection-traffic
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 1500
id-randomization
policy-map TCP
class TCP
set connection conn-max 1000 embryonic-conn-max 1000 per-client-max 250 per-client-embryonic-max 250
set connection timeout dcd
set connection advanced-options Normalizer
set connection decrement-ttl
policy-map type inspect http HTTP
parameters
protocol-violation action drop-connection log
class BlockDomains
policy-map global_policy
class inspection_default
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
inspect dns preset_dns_map dynamic-filter-snoop
inspect http HTTP
service-policy global_policy global
service-policy TCP interface External
smtp-server 199.185.220.249
privilege cmd level 3 mode exec command perfmon
privilege cmd level 3 mode exec command ping
privilege cmd level 3 mode exec command who
privilege cmd level 3 mode exec command logging
privilege cmd level 3 mode exec command failover
privilege cmd level 3 mode exec command vpn-sessiondb
privilege cmd level 3 mode exec command packet-tracer
privilege show level 5 mode exec command import
privilege show level 5 mode exec command running-config
privilege show level 3 mode exec command reload
privilege show level 3 mode exec command mode
privilege show level 3 mode exec command firewall
privilege show level 3 mode exec command asp
privilege show level 3 mode exec command cpu
privilege show level 3 mode exec command interface
privilege show level 3 mode exec command clock
privilege show level 3 mode exec command dns-hosts
privilege show level 3 mode exec command access-list
privilege show level 3 mode exec command logging
privilege show level 3 mode exec command vlan
privilege show level 3 mode exec command ip
privilege show level 3 mode exec command failover
privilege show level 3 mode exec command asdm
privilege show level 3 mode exec command arp
privilege show level 3 mode exec command ipv6
privilege show level 3 mode exec command route
privilege show level 3 mode exec command ospf
privilege show level 3 mode exec command aaa-server
privilege show level 3 mode exec command aaa
privilege show level 3 mode exec command eigrp
privilege show level 3 mode exec command crypto
privilege show level 3 mode exec command ssh
privilege show level 3 mode exec command vpn-sessiondb
privilege show level 3 mode exec command vpnclient
privilege show level 3 mode exec command vpn
privilege show level 3 mode exec command dhcpd
privilege show level 3 mode exec command blocks
privilege show level 3 mode exec command wccp
privilege show level 3 mode exec command dynamic-filter
privilege show level 3 mode exec command webvpn
privilege show level 3 mode exec command service-policy
privilege show level 3 mode exec command module
privilege show level 3 mode exec command uauth
privilege show level 3 mode exec command compression
privilege show level 3 mode configure command interface
privilege show level 3 mode configure command clock
privilege show level 3 mode configure command access-list
privilege show level 3 mode configure command logging
privilege show level 3 mode configure command ip
privilege show level 3 mode configure command failover
privilege show level 5 mode configure command asdm
privilege show level 3 mode configure command arp
privilege show level 3 mode configure command route
privilege show level 3 mode configure command aaa-server
privilege show level 3 mode configure command aaa
privilege show level 3 mode configure command crypto
privilege show level 3 mode configure command ssh
privilege show level 3 mode configure command dhcpd
privilege show level 5 mode configure command privilege
privilege clear level 3 mode exec command dns-hosts
privilege clear level 3 mode exec command logging
privilege clear level 3 mode exec command arp
privilege clear level 3 mode exec command aaa-server
privilege clear level 3 mode exec command crypto
privilege clear level 3 mode exec command dynamic-filter
privilege cmd level 3 mode configure command failover
privilege clear level 3 mode configure command logging
privilege clear level 3 mode configure command arp
privilege clear level 3 mode configure command crypto
privilege clear level 3 mode configure command aaa-server
prompt hostname context
no call-home reporting anonymous
call-home
profile CiscoTAC-1
no active
destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
destination address email [email protected]
destination transport-method http
subscribe-to-alert-group diagnostic
subscribe-to-alert-group environment
subscribe-to-alert-group inventory periodic monthly
subscribe-to-alert-group configuration periodic monthly
subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:41a021a28f73c647a2f550ba932bed1a
: end
Many thanks,
Ingo

Hi Jose,
here is what I got now:
ASA(config)# sh run | begin tunnel-group
tunnel-group DefaultWEBVPNGroup general-attributes
address-pool VPNPool
authorization-required
and DAP debugging still the same:
ASA(config)# DAP_TRACE: DAP_open: CDC45080
DAP_TRACE: Username: tom.tucker, aaa.cisco.grouppolicy = DfltGrpPolicy
DAP_TRACE: Username: tom.tucker, aaa.cisco.username = tom.tucker
DAP_TRACE: Username: tom.tucker, aaa.cisco.username1 = tom.tucker
DAP_TRACE: Username: tom.tucker, aaa.cisco.username2 =
DAP_TRACE: Username: tom.tucker, aaa.cisco.tunnelgroup = DefaultWEBVPNGroup
DAP_TRACE: Username: tom.tucker, DAP_add_SCEP: scep required = [FALSE]
DAP_TRACE: Username: tom.tucker, DAP_add_AC:
endpoint.anyconnect.clientversion="3.1.02026";
endpoint.anyconnect.platform="win";
DAP_TRACE: Username: tom.tucker, dap_aggregate_attr: rec_count = 1
DAP_TRACE: Username: tom.tucker, Selected DAPs: DfltAccessPolicy
DAP_TRACE: Username: tom.tucker, DAP_close: CDC45080
Unfortunately, it still doesn't work. Hmmm.. maybe a wipe of the config and starting from scratch can help?
Thanks,
Ingo

Enable anonymous access for Javascript Client Object Model

In SharePoint 2010 it was possible to use the Javascript Client Object Model with anonymous access enabled by removing "GetItems" from the ClientCallableSettings.AnonymousRestrictedTypes.
In SharePoint 2013 however, it seems that an extra security barrier has been implemented. Trying to use the Javascript Client Object Model results in the following message: "Access denied. You do not have permission to perform this action or access this
resource."
After this I went on to do a little research, and it appears that Javascript Client Object Model actually relies on the REST API (please correct me if I'm mistaken), and the REST API also doesn't seem to work as an anonymous user.
So I'm in the dark here. I can't imagine that SharePoint 2013 (so heavily relying on the client object model) can't be used with anonymous access. I've also found very little documentation on anonymous access in combination with SharePoint 2013.
So, how do I enable the Javascript Client Object Model to be used with anonymous access enabled?
P.S. Needless to say, my web application is enabled for anonymous access and so is my site collection.

There are really 4 things you need to do to enable anonymous access:
1. In web application level, enable anonymous.
2. In site collection level, make sure anonymous access Entire Website.
3. In Web level, set Full Permission Masks, till here, you're able to anonymously access REST APIs.
# Enable Anonymous access
$web = Get-SPWeb $url
if($web -ne $null)
Write-Host
Write-Host -ForegroundColor Yellow "Enabling Anonymous access on:" $web.Url
Write-Host
$web.AnonymousState = "On"
Write-Host -ForegroundColor Yellow "AnonymousState set to:" $web.AnonymousState
$web.AnonymousPermMask64 = "FullMask"
Write-Host -ForegroundColor Yellow "AnonymousPermMask64 set to:" $web.AnonymousPermMask64
$web.Update()
Write-Host
Below are the things to enable anonymous client object model APIs:
4. In web application level, Require Use Remote Interfaces Permission - uncheck it.
5. In web application level, Anonymous Restricted Types, remove all of them:
$app.ClientCallableSettings.AnonymousRestrictedTypes.RemoveAll()

Client host rejected: Access denied

Getting a ton of bounced back emails most likely the address is no longer in use but I filtered out any of the emails that say so. I'm no professional at this thats why I'm looking for help here. I tried searching for the problem on the forum but found
stuff about server 2003.
Im getting alot of the kickbacks saying Client host rejected: Access denied
I've tried emailing the recipient on my personal Gmail and recieved the same error. can we safely say that the addresses are no longer in use that i'm getting these kickbacks? heres the full header for anyone
who wants to look.
The original message was received at Wed, 5 Mar 2014 15:29:34 -0500 from odbmap07.extra.chrysler.com [129.9.107.35]
 ----- The following addresses had permanent fatal errors ----- <mail address here>
 (reason: 554 5.7.1 <unknown[151.171.97.83]>: Client host rejected: Access denied)
 ----- Transcript of session follows ----- ... while talking to odbmap07.out.extra.chrysler.com.:
<<< 554 5.7.1 <unknown[151.171.97.83]>: Client host rejected: Access denied
554 5.0.0 Service unavailable
We are using someone to host our email server for more information.
I use a program called G-Lock easy mail to send out our newsletter.

Hi,
Which email client are you using to send and receive emails? G-Lock?
Please refer to the links below and check if they help:
http://www.symantec.com/business/support/index?page=content&id=TECH169847
http://support.mailhostbox.com/email-administrators-guide/error-codes
In addition, if you are not using Microsoft Outlook as your email client, it's better to contact the support for your mail client for further assistance.
Best Regards,
Steve Fan
TechNet Community Support

Access denied against DP for untrusted clients

Similar Messages

Maybe you are looking for