Enterprise Vault Mobile Search 10 - Impersonation Issue

[BigPhil]

Ok, I am once again working on trying to get Mobile Search 10 to work (gave up last time). I have done a fresh install on Windows 2008 R2 SP1, Windows 2003 SP2...same result with both..."Access Denied". It appears that the application is not properly passing the impersonation settings to the backend Enterprise Vault server. My question is this...does ANYBODY have EV10 and EV Mobile Search 10 working? I have a case open, but I have a strong feeling there is a bug in it. If you have EV 10, but no mobile search, can you try installing it and see if you can get it working?...takes about 10 minutes in all if you have to install IIS too. I have been installing it with "Basic Authentication" (Blackberry mode during setup...you'll see what I mean).

Symantec Case # 416-559-498

[AWMorris]

I have installed MobileSearch 10.0.1, with all default IIS settings, and got the same error as indicated in this post.  I then changed the EVMobileSearchAppPool to run under the NetworkService identity rather than the LocalSystem.  I then recycled my app pool and am able to access archived contents.  So the only variable with my setup is the Identity that the app pool runs under.

[AWMorris]

However, I have just run IISRESET and it is broken again.......

[BigPhil]

@AWMorris, I have been unable to find a solution to this still...I have tried it all. The AppPool should be set to LocalSystem because it you have Impersonation configured correctly, it will use the impersonated account and not the computer account (network service). I have a feeling its something to do with the Enterprise Vault server itself and not the web server. This was a fresh install of Windows 2008 R2 and EV 10 when it first came out. If you ever find a fix, please post back here with your findings!

[JesusWept3]

the more i read about this, the more im convinced this is a Kerberos issue on the server running the mobile search webapp

[BigPhil]

I have installed MobileSearch fresh on at least three freshly built servers (two Win2008R2 and one Windows 2003, all up-to-date and freshly built). From our last correspondence via pm, it appeared to me that kerberos was working correctly as I can see it properly passing my credentials to EV via kerberos. Two sessions are created, one for the impersonated account and one for the web servers machine account. EV is for some reason picking the web server machine account session when checking permissions on the archive.

[AWMorris]

A Dtrace on the Mobile Search server reveals the following

112 19:00:08.941  [3336] (w3wp) <1444> EV:L WinHttpRequest::OnCallback. WINHTTP_CALLBACK_STATUS_HEADERS_AVAILABLE.
113 19:00:08.941  [3336] (w3wp) <1444> EV:L WinHttpRequest::OnCallback. WINHTTP_CALLBACK_STATUS_HEADERS_AVAILABLE. Status code=500
114 19:00:08.941  [3336] (w3wp) <1444> EV:H WinHttpRequest::OnCallback. WINHTTP_CALLBACK_STATUS_HEADERS_AVAILABLE. X-EV-HRESULT = 0x80070005
115 19:00:08.941  [3336] (w3wp) <1444> EV:H WinHttpRequest::OnCallback exit. ERROR HR=0x80070005.
116 19:00:08.941  [3336] (w3wp) <1444> EV:M WinHttpRequest::Callback from WinHttp. pRequest->OnCallback failed with HR=0x80070005. Calling pRequest->OnResponseComplete.
117 19:00:08.941  [3336] (w3wp) <1444> EV:M IndexQueryServerRequest: OnResponseComplete - HR=Access is denied.  (0x80070005)
118 19:00:08.941  [3336] (w3wp) <1256> EV:L IndexQueryServerRequest: WaitForSingleObject returned 0.
119 19:00:08.941  [3336] (w3wp) <1256> EV:M IndexQueryServerRequest: Waiting for 120000ms for request to complete.
120 19:00:08.941  [3336] (w3wp) <1256> EV:L IndexQueryServerRequest: WaitForSingleObject returned 0.
121 19:00:08.941  [3336] (w3wp) <1256> EV:H IQSFederatedSearchItem::GetResults2. Request FAILED HR=0x80070005.

I am going to test this on a Server 2003 box to see if the results differ.  Maybe something with the version of IIS is causing all of this.

[AWMorris]

Additionally, the following errors are logged on the Mobile Search server.

7002

Web Application (WP)

Application: EVSMD

EvWrapper::Search() : Details: Access is denied.  (0x80070005)

7002

Web Application (WP)

Application: EVSMD

EvWrapper::GetSearchResults() : Details: Access is denied. (0x80070005)

7002

Web Application (WP)

Application: EVSMD

SearchResult::Page_Load() : Details: Access is denied. (0x80070005)

[AWMorris]

OK.  So the problem is the same when Mobile Search is installed on a Server 2003 SP2 box.

[MichelZ]

Hi

Any luck with that?
I got a kinda similar problem...  ASP.NET app not properly impersonating to the EV API.
 

Cheers
Michel

[MichelZ]

Oh, and yes... I also think it's some sort of Kerberos issue... :(

[AWMorris]

Unfortunately, no.  I had a case open with Symantec and they had begun troubleshooting the issue.  The customer that I was working with decided to scrap Mobile Search so we haven't investigated it further.

[AndrewB]

just out of curiosity, any updates on this issue?

[AWMorris]

This article was discovered by UMSystems (Symantec Connect profile) today which might help out.

http://www.symantec.com/docs/TECH188383

Apparently, the EV API isn't sufficient enough to host Mobile Search in EV 10 SP 1.