Forest Issue RRS feed

  • Question

  • I have a connection issue between development machines.  It appears to be a cross-domain issue.  We've tried quite a number of solutions to no avail.  Including putting both SQL Server and PAS on the same machine.  It's something in the network security setup that is keeping ProClarity PAS from working properly.  Kerberos is not an option at this time.  We are trying to get ProClarity PAS working in both Standard and Professional mode.  We get one mode working on one server and but not both on the same server.


    But we have a clue.  We have this error message in the event log:


    CN=Grant Anderson,OU=Contractors,OU=Extranet,OU=XYZ,DC=XYZ,DC=XYZ_Domain,DC=org from a different forest logged onto this machine. Cross Forest Group Policy processing is disabled and loopback processing has been enforced in this forest for this user account.


    Does this look familiar to anyone?  Can anyone point me to the specific security settings that are causing this problem based upon this event log message?




       - Grant

    Friday, May 30, 2008 6:49 PM


All replies

  • Grant,


    Here is what I found on that message:



    This appears to be an Active Directory issue and you may consider posting this to a forum with a focus on those issues.


    If you have PAS and SSAS on different machines, then your main option is Basic Authentication.  Are you getting a specific error when it fails?  Can you use Basic?  Can you connect using Basic and a user from the target resource domain?  (The domain that the PAS machine belongs to). 




    Monday, June 2, 2008 3:02 PM
  • Joey,


    Thank you very much for your response and the link.


    The weird thing is that Basic Authentication does not fix the problem (ProClarity Professional works but Standard does not) on a development server in my current corporate environment even with both PAS and SQL Server AS on the same server.  It does, however, work fine on my development PC even when it is accessing cubes on a development AS2005 server.  It seems that there is some security related configuration on this organizations servers that is interfering with ProClarity Standard working.  It is something non-obvious so we are having a difficult time figuring it out.  We've tried many variations of authentication and users/groups (domain and non-domain) without success.


    I will forward the link to our networking people and see if this helps them figure it out.


    Our next step is to go to kerberos authentication which should cure this problem.


    Thank you!


       - Grant

    Monday, June 2, 2008 8:04 PM
  • Grant,


    Here is a link to a HTTP Debugging Tool called Fiddler:




    Try tracing your access with this tool when using the Standard Client.  It may give you some insight into what is or isn't getting passed along when trying to connect.  I know that this tool can help a lot in helping to diagnose these kinds of problems.




    TJ Nelson


    Wednesday, June 4, 2008 10:49 PM