none
Project Server 2010 behind ISA 2006 - NTLM Authentication Issues RRS feed

  • Question

  • Hello,

    We are currently experiencing issues with regard to Project Server 2010 when proxied behind ISA Server 2006 SP1.  The issue is that users will experience an error message within the Project web site (PWA) when accessing some web parts.  The error states "Cannot communicate with the server.  Verify your connection and try again."   We have determined that the error is related to authentication rather than a connectivity issue.  Initially the Project Server and ISA rules were setup to use NTLM authentication. 

    When viewing the logs of the ISA servers we can see that every time this error occurs on the browser that ISA is logging a "Failed Connection Attempt" with the status code of "12210 An Internet Server API (ISAPI) filter has finished handling the request. Contact your system administrator. "

    When reviewing the IIS logs of the Project Server we note that the event logged is a 401.2 error and that the user-name is blank (anonymous), followed by a 401.1 error.

    Because it is NTLM, once the user reclicks the web part, authentication is again challenged and the user is able to proceed with no problems.

    We understand that Integrated Authentication has been seen not to function correctly behind a proxy, but have not seen this behavior with our Project Server 2007 farm in which we do use NTLM authentication with no issues.

    At this time we have moved our authentication delegation in ISA to Basic Authentication and changed the authentication provider on Project as well to Basic.  It is functional, but there is concern that this is not Microsofts best practice with Sharepoint.  We are using Basic authentication over SSL.  The ISA Listener is set for HTML Forms Authentication as well.

    Any help is appreciated.

    Thanks.

    Tuesday, September 14, 2010 9:00 PM

Answers

  • I am seeing multiple issues here.

    Configure alternate access mappings (Office SharePoint Server) appropriately.
    http://technet.microsoft.com/en-us/library/cc261814(office.12).aspx

    Remove basic the authentication, make it Integrated Windoes Authentication.

    Remove Ananymous in case you enabled on the PWA web application.

    Remove IIS compression on PWA web application and Office web services.

    Remove the SSL and check 'http', later update the certificate and check the status.

    Ensure that the certficate has validity period.

    Is it NetBIOS URL or Hostheader? Make it NetBIOS and check the behaviour.

     

     

     


    Cheers. Happy troubleshooting !!! Sriram E - MSFT Enterprise Project Management
    Wednesday, September 15, 2010 11:12 PM
    Moderator

All replies

  • I am seeing multiple issues here.

    Configure alternate access mappings (Office SharePoint Server) appropriately.
    http://technet.microsoft.com/en-us/library/cc261814(office.12).aspx

    Remove basic the authentication, make it Integrated Windoes Authentication.

    Remove Ananymous in case you enabled on the PWA web application.

    Remove IIS compression on PWA web application and Office web services.

    Remove the SSL and check 'http', later update the certificate and check the status.

    Ensure that the certficate has validity period.

    Is it NetBIOS URL or Hostheader? Make it NetBIOS and check the behaviour.

     

     

     


    Cheers. Happy troubleshooting !!! Sriram E - MSFT Enterprise Project Management
    Wednesday, September 15, 2010 11:12 PM
    Moderator
  • Thank you.  I will walk through these suggestions, test and will respond back within the next few days.
    Thursday, September 16, 2010 4:06 PM
  • Moedes - did you ever have any luck resolving this?  I am having exact same problem and just can't figure out how to resolve.  Thanks for any updates!

    Josh

    Tuesday, October 12, 2010 9:07 PM
  • Hello,

    We are having the exact same issues as stated above. Sometimes the Connection is allowed at _vti_bin/PSI/ProjectServer.svc and gets status 200 OK when monitored in TMG. Sometimes it gives a failed connection attempt. Status: 12210 An Internet Server API (ISAPI) filter has finished handling the request. Contact your system administrator.

    Did any of you find the solution to this problem?

    Thanks in advance for any help.

    Rene

    Thursday, March 3, 2011 1:44 PM