Application Catalog website only accessible from server - clients give 401

Hi,
I have a weird problem, something has gone screwy in the IIS config I think.
I've had the SCCM 2010 R2 application catalog set up and running fine for some time. Recently I installed MBAM (Bitlocker Management) on the SCCM server. MBAM creates it's own website in IIS.
Following installation of MBAM the application catalog isn't fully working.
Clients trying to access http://servername/CMApplicationCatalog get asked repeatedly for credentials before getting a 401 error.
Clients accessing http://SERVER.IP4.ADDRESS/CMApplicationCatalog or http://servername/CMApplicationCatalog from the server see the application catalog without an authentication prompt (although they get an error if they try to install anything)
Browsing to http://localhost/CMApplicationCatalog from the server works properly - no authentication prompt and can install software.
The server is in the list of IE trusted sites. I've tried removing and reinstalling the Application Catalog roles.
Any idea what the problem is here?
Thanks,
Tim

Hi,
Thanks both - I don't see anyhthing strange in the IIS logs.
This is an example of it failing trying to access it by name manually entering details in the authentication box.
10.0.0.100 GET /cMApplicationCatalog/ - 80 - 10.0.0.163 Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+6.3;+WOW64;+Trident/7.0;+.NET4.0E;+.NET4.0C;+InfoPath.3;+.NET+CLR+3.5.30729;+.NET+CLR+2.0.50727;+.NET+CLR+3.0.30729)
- 401 2 5 1542 1268
10.0.0.100 GET /cMApplicationCatalog/ - 80 - 10.0.0.163 Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+6.3;+WOW64;+Trident/7.0;+.NET4.0E;+.NET4.0C;+InfoPath.3;+.NET+CLR+3.5.30729;+.NET+CLR+2.0.50727;+.NET+CLR+3.0.30729)
- 401 2 5 1542 3
10.0.0.100 GET /cMApplicationCatalog/ - 80 - 10.0.0.163 Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+6.3;+WOW64;+Trident/7.0;+.NET4.0E;+.NET4.0C;+InfoPath.3;+.NET+CLR+3.5.30729;+.NET+CLR+2.0.50727;+.NET+CLR+3.0.30729)
- 401 2 5 1542 2
10.0.0.100 CCM_POST /bgb/handler.ashx RequestType=LogIn 80 - 10.0.0.163 ccmhttp - 200 0 0 304 0
10.0.0.100 GET /browserconfig.xml - 80 - 10.0.0.163 Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+6.3;+Win64;+x64;+Trident/7.0;+.NET4.0E;+.NET4.0C;+InfoPath.3;+.NET+CLR+3.5.30729;+.NET+CLR+2.0.50727;+.NET+CLR+3.0.30729)
- 404 0 2 1405 2
10.0.0.100 CCM_POST /bgb/handler.ashx RequestType=Continue 80 - 10.0.0.163 ccmhttp - 200 0 0 1258 4405
This is accessing it by IP, with the transparent authentication working.
10.0.0.100 GET /cMApplicationCatalog/ - 80 - 10.0.0.163 Mozilla/5.0+(Windows+NT+6.3;+WOW64;+Trident/7.0;+rv:11.0)+like+Gecko - 401 2 5 1542 1
10.0.0.100 GET /cMApplicationCatalog/ - 80 DOMAIN-LOCAL\USER 10.0.0.163 Mozilla/5.0+(Windows+NT+6.3;+WOW64;+Trident/7.0;+rv:11.0)+like+Gecko - 200 0 0 1851 224
10.0.0.100 GET /cMApplicationCatalog/ClientBin/en-GB/en-GB.xap - 80 DOMAIN-LOCAL\USER 10.0.0.163 Mozilla/5.0+(Windows+NT+6.3;+WOW64;+Trident/7.0;+rv:11.0)+like+Gecko http://10.0.0.100/cMApplicationCatalog/ClientBin/Microsoft.ConfigurationManager.SoftwareCatalog.Portal.xap?ver=5.0.7958.1000
404 0 2 1461 1
10.0.0.100 GET /cMApplicationCatalog/ClientBin/en/en.xap - 80 DOMAIN-LOCAL\USER 10.0.0.163 Mozilla/5.0+(Windows+NT+6.3;+WOW64;+Trident/7.0;+rv:11.0)+like+Gecko http://10.0.0.100/cMApplicationCatalog/ClientBin/Microsoft.ConfigurationManager.SoftwareCatalog.Portal.xap?ver=5.0.7958.1000
404 0 2 1461 2
10.0.0.100 POST /cMApplicationCatalog/ApplicationViewService.asmx - 80 DOMAIN-LOCAL\USER 10.0.0.163 Mozilla/5.0+(Windows+NT+6.3;+WOW64;+Trident/7.0;+rv:11.0)+like+Gecko http://10.0.0.100/cMApplicationCatalog/ClientBin/Microsoft.ConfigurationManager.SoftwareCatalog.Portal.xap?ver=5.0.7958.1000
200 0 0 772 429
10.0.0.100 POST /cMApplicationCatalog/ApplicationViewService.asmx - 80 DOMAIN-LOCAL\USER 10.0.0.163 Mozilla/5.0+(Windows+NT+6.3;+WOW64;+Trident/7.0;+rv:11.0)+like+Gecko http://10.0.0.100/cMApplicationCatalog/ClientBin/Microsoft.ConfigurationManager.SoftwareCatalog.Portal.xap?ver=5.0.7958.1000
200 0 0 2054 404
The difference I can see is that no credentials are showing in the logs in the top example.
I have checked IE settings which appear to be correct. Checking File -> Properties in IE shows the zone as Local intranet | Protected Mode: Off in both cases.
Tim

Similar Messages

SCCM 2012 Application Catalog Website Point role Status is critical

Hi team,
In a client's SCCM 2012 R2 environment there is a Critical Icon and Status against one of two Application Catalog Website point roles. Looking at the Component status, there are no errors and all the components show as green.
Trying to find any warnings or errors in the messages for the Site System role doesnt show any errors, and I tried to reset counts but this has not changed the status.
I am not sure where to go from here. The application catalog itself works and is up. All the services are running. I am unsure as to where this error status comes from or what it pertains to.
Any advice would be appreciated.

Hi,
Please check portlctl.log and awebsctl.log to see if there is any error.
You could also check the thread below.
Symptom: Reporting Services Point Status (under Monitoring - System Status - Site Status) appears as Critical, No error messages in logs or status messages
Cause: 'Status' can be set to "2" for 'SMS SRS Reporting Point' in dbo.summarizer_sitesystem table in sql
Resolution: > Run below query:
update dbo.summarizer_sitesystem set status = '0' where SiteSystem = '["Display=\\abc.local\"]MSWNET:["SMS_SITE=ABC"]\\abc.local\' and role = 'SMS SRS Reporting Point'
> It should set the status back to 0.
> Check in console and errors should go away.
> In case if value reverts back then check below namespace in wmi of site server:
root\sms\site_pri\sms_sitesystemsummarizer
> check the value for reporting services point, ideally it should be 0, let's say it's set to 2 there as well then remove role of reporting services point.
> if entry for reporting services point goes away from both the places then it's good, you can re-install the reporting services point and it should work fine.
> Let's say if value/values doesn't get removed from sql/wmi , remove them manually via queries and then go with uninstall and re-install.
> then it should work and errors in console and common.log should go away.
https://social.technet.microsoft.com/Forums/en-US/5e0b7af6-f00c-4610-a709-f3e0e26505be/sccm-2012-monitoring-site-status-reporting-services-point-status-critical?forum=configmanagergeneral
Best Regards,
Joyce
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected]

Application Catalog Website Point Status Critical - But why?

I am having some tracking down what is causing this status on a customer's primary site. I've checked the portlctl.log and awebsctl.log where both show a status 0 of running. When I try to reset the status of the Application Catalog website point the status
does not reset and there are no error messages when I query the status messages. Is there something else I can do to try and get the status into the right state?
www.bighatgroup.com

I've seen this behavior more often, with different customers. It's always the Application Catalog web site point that shows an error state while it's functioning correct. From what I've seen, the behavior starts after a reinstallation of the role, either
because of a hotfix, service pack, or cu installation.
Also the only workaround I've found so far that works, is reinstalling the role again...
My Blog: http://www.petervanderwoude.nl/
Follow me on twitter: pvanderwoude

SCCM 2012 SP1 Application catalog website

Architecture:
SCCM 2012 SP1 installed on Windows 2012
Application catalog website issue----->
In SMSAWEBSVCSetup.log we found "IIS component ASP net not installed please install it.
Installlation failed Error Code:125"
whereas we have installed ASP.net already (registering ASp. net not supported please review the MS article: "http://support.microsoft.com/kb/2736284 "
Let know me know what could be the cause.

All depending on how/what order you install the IIS components sometimes it's just to reinstall IIS. To me it sounds like the .Net Framework http-activation and non-activation features are missing.
Kent Agerlund | My blogs: blog.coretech.dk/kea and
SCUG.dk/ | Twitter:
@Agerlund | Linkedin: Kent Agerlund |
Mastering ConfigMgr 2012 The Fundamentals

BPC Report emails only work from server (not client) - BPC v5.1

Hi all.
Hope someone might have seen something like this before.
Basically, I setup our servers to send email from BPC about 3 weeks ago.
(NB - If it makes a difference, we use Lotus Notes via a Domino server)
The SMTP settings are all correct in BPC WebAdmin, the servers have been added to the allow list on the mail server and the port is open.
Anyway, when I try to send mail from a client (using the Offline Report Distribution Wizard), I get the following error:
"The transport failed to connect to the server".
At SAP's suggestion, I ran a test by installing Office and a BPC client directly onto the Web Server.
When I ran the wizard from the server, the email sent perfectly.
The problem I have now is that although I informed SAP of the test outcome, I haven't heard anything back in about 3 weeks, and I really need to get the reporting email system up and running properly.
Does anyone have any suggestions on what could be causing this?
It's as though the system is telling the client to send the email itself, via the forwarding server, but this would mean allowing every user PC to access the mail server.
Hope you can help, but thanks for looking either way.
Craig

Hi Ludovic
The problem turned out to be mail server white-lists, due to the way that BPC sends emil.
Although you setup the email account/profile on the server, it actually sends from the client PC of whichever user makes the email request.
Our system is only configured to block all email requests with individual exceptions (ie a White-List).
It needed the PC of every user who would need to send email from the BPC system to be added to the white-list.
This is why it worked from the server, as we had added the server address to the list as part of the testing.
Not reall y a BPC problem, more of an issue with functionality due to the method that it uses to send the messages.
Hope that helps
Craig

What is the best approach to send/recv multiple types of network packets from server/client?

I am writing two programs (server.vi) and (client.vi). that communicate with each other over a TCP connection.
After the client opens a TCP connection with the server, the server responds with a packet of type "A". The client sends another packet of type "A" back to the server as an acknowledgement. At this point the server starts sending a continous stream of packets of type "B" to the client. And the client starts sending a continous stream of packets with type "C".
This means the sending an receiving of packet with types B and C will be in parallel.
How should I implement something like this in labview?
Here is one idea i have and I was hoping someone could either comment or provide a better suggestion.
1. the server has two while loops
     a. first while loop consists of a TCP read function that receives packets of type "C".
     b. second while loop consists of a TCP write function that sends packets of type "B"
2. the client has two while loops
    a. first while loop consists of a TCP write function that sends packets of type "C"
     b. second while loop consists of a TCP read function that receives packets of type "B".
This way we are sending and receiving packets of type "B" and "C" in parallel.
Does this make any sense? Is there a more clever / better aproach to doing this?

Putting the sending and receiving code in separate loops is a reasonable thing to do. You will need a bit of logic to handle a dropped connection, since you will need to pass the new connection information to both loops when the connection is re-established.

HT5858 Bug with control centre? - only accessible from lock screen

I cannot access Control Center from my home screens or within apps, only from the Lock Screen - very annoying if I want to switch my music output for example or use the torch.
My settings are on for both access from Lock Screen and Access from within Apps.
Is this a bug or I am doing something wrong?

Hello Adrian Biffen,
After reviewing your post, it sounds like you can't access Control Center from inside apps. I would recommend that you read this article, it may be able to help the issue.
Use Control Center on your iPhone, iPad, and iPod touch - Apple Support
If you're using an app that uses similar swipe gestures, like Maps or games, you might have to swipe up twice: once to reveal the handle for Control Center, and a second time to reveal Control Center.
Thanks for using Apple Support Communities.
Have a nice day,
Mario

Supporting details are not accessible from SmartView client

Hi All,
For one of our users Supporting detail functionality is not available using SmartView client. While clicking on Supporting detail option in excel, the bar is showing hour glass but never displaying the supporting detail window. We reinstalled the client but with no success. We are not sure what is causing this issue. Kindly share your thoughts around the possible causes.
P.S - We asked the user to go to planning web for the time being.
Thanks,
Praveen

What versions of software are you on? Smartview / Excel etc
If other users are fine and share common software versions, then this would point to something on the client machine....have a try of disabling all add-ins except Smart View to see if anything is conflicting?
I assume the behaviour is the same whether trying to interact with already existing supporting details or creating own?
JB

Need example of client requesting information from server

I have a thick-client application that also acts as a server for remote clients.
I have it set up so that they send messages to each other. The server can initiate action on the client and the client can initiate action on the server. All of my communication is essentially asynchronous.
Now I want to start adding more transactional synchronous interactions, for instance:
- User initiates action on client
- Client gets data from server
- Client uses that information to perform further action
Is there a good example or tutorial for someone who hasn't done that before?

If you want to keep it a J2SE app im not sure you can use JMS to do it, but would have to use RMI or just plain network programming, with lots of thread control.
Anyhow if you would like to do it the easy way run a J2EE server, find a small one, but one that supports JMS (think one of the minimal installs of jboss might be good). Make a topic called messageExchange or somethign. Connect server/client to the topic. Can use MVC or something as a messagelistener. You can even persist the topic (DurableTopic) to log events to a database.
This is a little job that requires little planning compared to setting up a thread hieracy with sockets flying all around. And easier than rmi.
I have really never tought of using JMS in outside of an J2EE container, but there might be some plugins or api's that support this for J2SE.
Thomas

OSB Proxy service accessible from client?

Are non SOAP/WSDL OSB business services accessible from outside the OSB? Or are these only accessible from other services within the OSB?
Thanks
Edited by: magic1007 on Mar 18, 2010 7:50 AM

Thanks!!
Now, I Know I'm near, because using the proxy service URL:
http://localhost:7001/PROJECT/ProxyServices/CompraDivisas_FIX
I have an answer from the explorer and other from de console, both of them are asking me for the request message... So, how should I send that request?? I have 2 cases:
1) I need to send as request a FIX string:
8=HeaderBeginID9=40386842735=MTB1128=5.0SP149=PROJECT56=TargetCompanyID91=CandadoSeguridad34=795538142=525557=TargetSubID143=TargetLocID116=NONE144=0129=043=N52=20090311-17:06:16.720213=XML_DATA369=118219457811=11=CPADIVI581=144=12.0015=EUR55=USD54=160=20090411-14:35:4238=1152=1516=10040=1432=20100210-17:06:16.72010=PJVVHFdsicvr8f16
2) My request is an XML:
<?xml version="1.0" encoding="UTF-8"?>
<QuoteRequestIM>
     <BeginString>BeginString</BeginString>
     <BodyLength>604607687</BodyLength>
     <MsgType>R</MsgType>
     <SenderCompID>SenderID</SenderCompID>
     <TargetCompID>PROJECT_ID</TargetCompID>
     <MsgSeqNum>1</MsgSeqNum>
     <SendingTime>2010-01-27T14:35:42</SendingTime>
     <QuoteReqID>QuoteRequestID</QuoteReqID>
     <RelatedSym>
          <Symbol>EUR/USD</Symbol>
          <Currency>EUR</Currency>
          <Legs>
               <LegSymbol>EUR/USD</LegSymbol>
               <LegQty>1000000.0</LegQty>
               <LegSettlType>0</LegSettlType>
               <LegSettlDate>2010-01-30</LegSettlDate>
               <LegRefID>A0001</LegRefID>
          </Legs>
          <Legs>
               <LegSymbol>EUR/USD</LegSymbol>
               <LegQty>1000000.0</LegQty>
               <LegSettlType>6</LegSettlType>
               <LegSettlDate>2010-02-28</LegSettlDate>
               <LegRefID>A0002</LegRefID>
          </Legs>
          <ExpireTime>2006-01-27T14:35:42</ExpireTime>
     </RelatedSym>
     <CheckSum>QBp0r7s7J_nsKe3p</CheckSum>
</QuoteRequestIM>
How, when & where can I introduce this request to my proxy service??
Thanks a lot Anuj!!!
WaLeX

Application Catalog Site URL Auto Selection Producing Unexpected Results

Hi All,
Thank you in advance for the help.
We have a client with about 90k computers managed by a CAS and four child primary sites. Each of the four primary sites exists in the AN forest and
has a DMZ remote site system with MP, DP, SUP and AppCatalog Website Roles to support IBCM clients in the AN forest. The AppCatalog WebService Role is hosted on the primary site servers themselves.
Additionally we support two remote non-trusted forests, CVGH and QH. We have deployed a single DMZ server in each of the remote forests with MP, DP,
SUP and AppCatalog Website Roles to support IBCM clients in the remote forests. (There are also Intranet site systems in the CVGH and QH forests supporting these forests’ clients within the primary sites.)
All certificates are configured correctly. All authentication is working as expected. Clients in remote forests are able to deploy packages/applications/software
updates via Computer Policy and User Policy successfully. Each DMZ server has its own Internet published FQDN and is configured for Internet Only client communication via https.
Clients within the AN forest connected via the IBCM DMZ servers in the AN forest are provided with the correct Internet facing FQDN for their respective site’s Application
Catalog and these FQDNs are successfully inserted into the Trusted Sites Zone. For example, a client in the PR1 site that exists in the AN forest is furnished with the FQDN for that site’s AN DMZ remote site system. This results in the Application Catalog
link in Software Center successfully launching the Application Catalog from the Internet. The user is prompted for credentials from the AN forest and successfully authenticates to the Application Catalog and is able to install software as desired.
Clients within a remote non-trusted forest should be furnished with the FQDN of the remote non-trusted forest’s DMZ site system within the PR1 site for example. A client
in the QH forest which is managed by a DMZ server in the QH forest which is attached to the PR1 site is not, however, furnished with the correct FQDN for the QH forest’s DMZ site system. Instead it receives the FQDN of the AN forest’s DMZ site system. This
results in user’s attempting to launch the Application Catalog from the link in Software Center and being prompted for authentication against the wrong Application Catalog URL (in the wrong forest) and hence against the wrong forest entirely.
If we manually open a browser from a ConfigMgr client computer in the QH forest and open the correct FQDN URL for the QH DMZ site server’s Application Catalog website
instance from the Internet we are prompted to authenticate against the correct (QH) forest and are able to successfully download applications from the Application Catalog.
The issue is that per Technet the QH client should be furnished (or choose I’m not sure) the FQDN of the https: enabled DMZ site server in its forest as its Application
Catalog Website URL according to the rules of Application Catalog Automatic Site Selection (right?). The clients in our remote forests are not being provided with the correct FQDN for their respective forest’s DMZ site system’s Application Catalog roles or
are not updating these FQDNs in the Software Center link to the Application Catalog Website.
I have closely followed this article for troubleshooting:
http://blogs.technet.com/b/configmgrteam/archive/2012/07/05/tips-and-tricks-for-deploying-the-application-catalog-in-system-center-2012-configuration-manager.aspx
We believe our Default Client Settings are configured correctly as the Application Catalog website configuration is set to auto-detect. There is a higher priority workstation
only Client Settings that has the same auto-detect configuration for the Application Catalog that we believe is configured correctly as well.
We do not believe configuring another Custom Client Setting to hard code a URL for the remote forest would work as it would point Intranet computers to the FQDN for
the Internet DMZ servers when they should be pointed at the Intranet remote site systems for their respective forests.
LocationServices.log and ClientIDManagerStartup.log both fail to indicate any issues that I can identify. Clients are successfully assigned to the correct sites. Clients
are able to communicate with their respective Management Points in the DMZ. No errors are shown in the Application Catalog websites when they are manually accessed by their correct FQDNs.
There are no errors that I have seen in the portal logs for the Application Catalogs. As evidenced by their successful functionality when manually specifying the correct
site system’s FQDN in a browser we have no reason to believe that there is an issue with the Application Catalog websites themselves just the mechanism by which ConfigMgr clients are furnished with the correct FQDN for their forest and DMZ site system.
Again, thank you for your help. Any input is much appreciated.

Spoke to CSS. This is expected behavior FYI.

RMAN from windows client to a Oracle db on Linux

hi all
we have a architecture where in Oracle 10g R2 RAC is installed on SuSe Linux Itanium systems. Its a two node RAC. this is production
We have another server which is in another network (cannot connect to production network) this is development. This dev server is x86_64 Suse Linux
RMAN is used for backup on production and a catalog database also exists there.
We need to take a backup of the production and restore it on the dev environment. a normal RMAN backup involving the catalog database doesnt work as catalog database isnt accessible from the remote network.
we access the two servers by changing the network cable on our desktops ...
my query is:
can i take a RMAN backup of the production italicswithout using the catalog italics on my desktop from a windows oracle client? And then restore from the same windows machine into the database in the development environment.?
does RMAN support the cross platform backup and restore?

Yes it does, check RMAN Cross-Platform Transportable Databases and Tablespaces, but it appears that your PROD and DEV are both Linux boxes, so you shouldn't have a problem doing a normal backup/restore.

Admin Console should not be accessible from the Internet

Hi!
I am using WebLogic 6.1 and by default the Admin Console runs under the same port
like the deployed web applications. As a matter of fact, the Admin Console can
been seen from the Internet! :(
Is there a way to start the Admin Console with another port? Or is there any other
solution that the Admin Console is only accessible from the Intranet but not from
the Internet??
I couldn't find anything in the documentation related to this topic.
Thanks in advance.
Markus Richter

One solution I use is to place an Apache WebServer in front of the BEA HTTP server and use the Apache/WebLogic module to proxy requests.
Apache is much more configurable, robust etc etc as a webserver. If you configure a specific Apache Virtual Server for connections to your Weblogic server you can use Apache ACL's to control access to the console via specific IP addresses only.
The ACL in the Apache Virtual Server configuration could like something like this.
<Location /console/>
order deny,allow
deny from all
allow from 10.0.0.1
</Location>
hope this helps.
Mark P

Application Catalog clarification

I have deployed an application to a collection and things work great. I have it set to "Install" and "Required" for the Deployment Action and Purpose. I was hoping this would show up on the Application Catalog website as well but I
do not see it listed. Isn't there a way for this existing deployment I created to also show up in the Application Catalog website for future use amongst my staff wishing to deploy this app to users? From what I am reading, you have to create a deployment as
"Available" and to All Users in order for it to show up? I don't want to go this route because I am deploying this in stages (user group 1 first, user group 2 second, etc).

Correct, that's the definition of an *available* deployment: user initiated only. And, as mentioned, deployments to users only show up in the app catalog.
Here's a good blog covering the details:
http://blogs.technet.com/b/configmgrteam/archive/2012/03/31/introducing-the-application-catalog-and-software-center-in-system-center-2012-configuration-manager.aspx
Jason | http://blog.configmgrftw.com | @jasonsandys

SCCM 2012 - Wrong user in application catalog

Hi everybody,
i´ve got some strange things with my SCCM 2012 Server.
The Software deployment works nearly perfect but there is a different user logged in the application catalog then logged into Windows.
Is there any chance to change the logged in user in the application catalog? Or anybody knows where SCCM takes the information to set the account?
Thanks and Regards

Internet Explorer usually uses the credentials of the logged-in user to connect to the Application Catalog website. Any chance that there are pre-existing connection to the server hosting the app catalog?
Torsten Meringer | http://www.mssccmfaq.de
I´ve made a hole IE10 reset and cleared the browser cache. There are no other existing connections to the Server.
Is there any chance to manually set the user used for the apllication catalog? Maybe in the UserProfile?

Application Catalog website only accessible from server - clients give 401

Similar Messages

Maybe you are looking for