"A migration batch is being processed" error when you try to perform a new migration in Office 365
A migration batch is being processed. To submit a new batch, wait until the current one is completed, or cancel it, and then submit a new batch.
Additionally, the New button isn’t available, and the current migration that’s in process doesn’t stop.
- Connect to Exchange Online by using remote PowerShell. For more information about how to do this, go to the following Microsoft website:
- Type the following command, and then press Enter:
- Type the following command, and then press Enter:
Article ID: 2395649 – Last Review: May 16, 2013 – Revision: 32.0
Applies to
- Microsoft Office 365 for enterprises (pre-upgrade)
- Microsoft Office 365 for education (pre-upgrade)
- Microsoft Exchange Online
| o365 o365a o365e o365062011 pre-upgrade o365022013 o365m after upgrade KB2395649 |
More here:
"A migration batch is being processed" error when you try to perform a new migration in Office 365
What you need to use Active Server Pages (ASP) in FrontPage 2002
Active Server Pages (ASP) technologies with Microsoft FrontPage. Before you can
view the results of ASP features in FrontPage, you must install the components
listed in this article.
ASP technology is designed for Web servers
based on Microsoft Internet Information Services (IIS). The following list
shows the platforms and Web servers that are supported:
- Windows Consumer Editions
- Microsoft Windows 95
- Microsoft Personal Web Server 1.0 or 4.0
- Microsoft Windows 98
- Microsoft Personal Web Server 1.0 or 4.0
- Microsoft Windows Millennium Edition (Me)
- There is no supported Web server for Windows Me.
For additional information, click the following article number to view the article in the Microsoft Knowledge Base:
266456(http://support.microsoft.com/kb/266456/
)Personal Web Server is not
included with Windows Millennium Edition
- There is no supported Web server for Windows Me.
- Microsoft Windows 95
- Microsoft Windows NT 4.0
- Microsoft Windows NT 4.0 Workstation
- Microsoft Peer Web Services 2.0, 3.0, or
4.0
- Microsoft Peer Web Services 2.0, 3.0, or
- Microsoft Windows NT 4.0 Server or Enterprise Server
- Microsoft Internet Information Server 2.0, 3.0, or
4.0
- Microsoft Internet Information Server 2.0, 3.0, or
- Microsoft Windows NT 4.0 Terminal Server
- There is no supported Web server for Windows NT 4.0
Terminal Server.- Microsoft Internet Information Services
5.0
- Microsoft Internet Information Services
- There is no supported Web server for Windows NT 4.0
- Microsoft Windows NT 4.0 Workstation
- Microsoft Windows XP
- Microsoft Windows XP Home Edition
- There is no supported Web server for Windows XP
Home Edition.For additional information, click the following article number to view the article in the Microsoft Knowledge Base:
304197(http://support.microsoft.com/kb/304197/
)Personal Web Server is not included with Windows XP Home
Edition
- There is no supported Web server for Windows XP
- Microsoft Windows XP Professional
- Microsoft Internet Information Services
5.1
- Microsoft Internet Information Services
- Microsoft Windows XP Home Edition
How to Find a Supported Web Server
Personal Web Server 1.0
This Web server is no longer available; however, you can install
it if you have the Microsoft FrontPage 97 or Microsoft FrontPage 98 compact
disc. It is located in the following folder on the compact disc
drive
WSENU
where drive represents the drive
letter of your CD-ROM drive.
Internet Information Server 2.0 or 3.0 and
Peer Web Services 2.0 or 3.0
These Web servers are included with Windows NT 4.0. You can
install either Web server if you have the Windows NT 4.0 compact disc. To
install the server, double-click the Inetstp.exe file in the following folder
on the compact disc
drive:I386INETSRV
where drive represents the drive
letter of your CD-ROM drive.
Internet Information Server 4.0, Peer Web Services 4.0, and
Personal Web Server 4.0
These Web servers are included with the Windows NT 4.0 Option
Pack. They are also available for download at the following Microsoft Web site:
You can also install Personal Web Server 4.0 if you have the
Windows 98 compact disc. This program is located in the following folder on the
compact disc
drive:add-onspws
where drive represents the drive
letter of your CD-ROM drive.
Internet Information Services 5.0
This Web server is included with Windows 2000. You can install it
when you initially install Windows 2000. Or, if you already installed Windows
2000, rerun Windows 2000 Setup to install it.
Internet Information Services 5.1
This Web server is included with Windows XP Professional. You can
install it when you initially install Windows XP Professional. Or, if you
already installed Windows XP Professional, rerun Windows XP Professional Setup
to install it.
ASP Engine
The ASP engine is a component of all IIS versions 4.0 and later.
If you have a version earlier than 4.0, you can download the ASP engine from
the following Microsoft Web site: The ASP engine is also included on the FrontPage 98 compact disc.
To install the ASP engine from the FrontPage 98 compact disc, open the
following folder
drive:60 Minute Intranet Kit60 Minute Intranet Kitmodules
where drive represents the drive
letter of your CD-ROM drive, and then double-click the Asp.exe file.
Note Do not install the ASP engine if you have already installed IIS
version 4.0 or later.
32-bit ODBC Driver
Open Database Connectivity (ODBC) is a widely accepted standard
that allows software to communicate with a database. To use the ASP
functionality in FrontPage, you must install the 32-bit ODBC database driver
for the database that you want to use on your Web server. For example, the
Northwind Sample database is a Microsoft Access database. To use this sample
database, you need to install the Microsoft Access ODBC driver on your Web
server.
For additional information about ODBC drivers, visit the
following Microsoft Web site:
FrontPage Server Extensions
FrontPage Server Extensions allow the FrontPage client to
communicate with a Web server and allow you to author remotely.
For additional information
about how to install and configure FrontPage Server
Extensions, click the following article numbers to view the articles in the Microsoft Knowledge Base:
(http://support.microsoft.com/kb/300004/
)
How to install and configure
FrontPage 2000 Server Extensions on a Windows NT-based Web Server (Windows NT
or Windows 2000)
(http://support.microsoft.com/kb/300543/
)
How to use
the command-line tools to install and configure the FrontPage Server Extensions
on IIS 4.0 and IIS 5.0
(http://support.microsoft.com/kb/300544/
)
How to use
the command-line tools to upgrade to FrontPage Server Extensions 2002 on
Windows
Troubleshooting
To verify a successful ASP installation, you can run the
following sample ASP code:
<%
Response.Write "Hello World!"
%>
To do this, follow these steps:
- Start FrontPage. Open the Web site by using the HTTP
address to connect to it. - Click the New Page button on the Standard toolbar.
- Click the HTML tab at the bottom of the FrontPage window to switch to HTML
view. - Click after the opening tag and then type the
following ASP code:<% Response.Write "Hello World!" %>
- On the File menu, click Save. In the File name box, type Asptest.asp and click Save.
- On the File menu, click Preview in browser.
The page opens in your Web browser and displays the
“Hello World!” message.Note If the page does not appear and you do not see the message,
review the list of required components earlier in this article.
numbers to view the articles in the Microsoft Knowledge Base:
(http://support.microsoft.com/kb/266456/
)
Personal Web Server is not included with Windows Millennium Edition
Article ID: 318287 – Last Review: May 16, 2013 – Revision: 7.0
| kbdownload kbhowto KB318287 |
View the original here:
What you need to use Active Server Pages (ASP) in FrontPage 2002
Cannot Resize the Chart Area of a chart located on a Chartsheet
Consider this scenario:
1. When you try to resize charts on a chart sheet, Excel displays the resize handle, but it won’t let you resize the chart.
2. After upgrading a file created in Excel 2007 if the chart is positioned to be small on the chart sheet, it will snap to maximum size on the chart sheet.
Workaround
-Resize the plot area and position other elements to match.
-Embed the chart in the worksheet instead of a chart sheet. To do this, follow these steps:
- Highlight the chart.
- On the Chart Tools ribbon choose Design
- Click on Move Chart
- Choose where you want the chart to be placed: Object in: Choose the worksheet tab you want to place it.
- Click OK.
(http://go.microsoft.com/fwlink/?LinkId=151500)
for other considerations.
Article ID: 2850644 – Last Review: May 15, 2013 – Revision: 1.0
Excerpt from:
Cannot Resize the Chart Area of a chart located on a Chartsheet
"Mailboxes listed in the following table can’t be migrated" error when you perform a staged Exchange migration to migrate on-premises mailboxes to Exchange Online
- You want to set up single sign-on (SSO).
- You have an on-premises Exchange Server environment but don’t want a full hybrid deployment with Exchange Online in Office 365.
- To implement SSO, you deploy Active Directory Federation Services (AD FS) 2.0 and use Active Directory synchronization to sync user accounts from your on-premises Active Directory directory service to Windows Azure Active Directory (Windows Azure AD).
In this scenario, when you perform a staged Exchange migration to migrate mailboxes from your on-premises environment to Exchange Online, you receive the following error message:
The mailboxes listed in the following table can’t be migrated because they contain errors.
Learn more…
When you click Learn more, you receive an error message that resembles the following:
joe@contoso.com
A Windows Live error occurred while provisioning for “joe@exch1.exchcloud.com”. An internal error occurred while talking to Windows Live. Additional details: “0x800482101033This action is currently blocked for the API. CH1IDOPRTI03 2011.09.07.15.30.48″.
Collapse this tableExpand this table
| EmailAddress | Password | ForceChangePassword |
| joe@contoso.com | False |
Article ID: 2845956 – Last Review: May 15, 2013 – Revision: 1.0
Applies to
- Microsoft Office 365 for enterprises (pre-upgrade)
- Microsoft Office 365 for education (pre-upgrade)
- Microsoft Exchange Online
- Windows Azure Active Directory
| o365 o365a o365e o365m o365062011 o365022013 pre-upgrade after upgrade KB2845956 |
See the article here:
"Mailboxes listed in the following table can’t be migrated" error when you perform a staged Exchange migration to migrate on-premises mailboxes to Exchange Online
When you access the Exchange Admin Center in Office 365, the Exchange Control Panel is shown instead
- The Exchange Control Panel from the earlier version of Office 365 is displayed on the page.
- The web browser session doesn’t show your user account as the user who is signed in. Instead, it shows the last user who signed in and accessed the Exchange Control Panel.
Article ID: 2783242 – Last Review: May 15, 2013 – Revision: 5.0
| o365a o365e o365p o365022013 o365m o365 after upgrade KB2783242 |
Read More:
When you access the Exchange Admin Center in Office 365, the Exchange Control Panel is shown instead
How to migrate mailbox data by using the Exchange Admin Center in Office 365
- Microsoft Exchange Server 2003
- Microsoft Exchange Server 2007
- Microsoft Exchange Server 2010
- Microsoft Exchange Server 2013
- Internet Message Access Protocol (IMAP)
(http://www.microsoft.com/en-us/office365/system-requirements.aspx#fbid=MEWL0OyeP-d)
Supported kinds of migration
In Exchange Online, IT admins have several options to migrate mailbox data from their existing on-premises or hosted environment. These options vary based on the source environment and the result that the customer wants to achieve. As with any deployment of Exchange Online in Office 365, customers can review the Exchange Server Deployment Assistant
(http://technet.microsoft.com/en-us/exchange/jj657516.aspx)
to determine the settings that they have to set up to reach the end state that they want.
Remote move
Remote move enables migration from a deployment of Exchange 2010 or later versions. It uses the Microsoft Exchange Mailbox Replication Service (MRS) Proxy service. For more information about remote moves, go to the following Microsoft TechNet website:
Staged migration
Staged migration enables migration from an on-premises Exchange 2003 or Exchange 2007 deployment. The main difference in this kind of migration is that the migration is targeted at customers who want to establish a permanent mail coexistence with Exchange Online and their on-premises environments. This requires that customers deploy directory synchronization when they deploy Exchange Online. This option is available for customers who have Enterprise Exchange licenses only. IT admins must provide a list of users to migrate in each batch by using a comma-separated values (CSV) file.
Cutover migration
The cutover migration option is for customers who want to migrate their whole environment at one time. This migration is limited to less than 1,000 mailboxes and is targeted at small to medium-sized business customers who are running Exchange 2003 or a later version in their environment. Specifically, this migration supports users who are using the Microsoft Exchange Autodiscover service against Exchange 2007 (or later-version) environments to determine the mailboxes that are available for migration. However, if you’re running Exchange 2003 in your on-premises environment, you can manually enter the remote procedure call (RPC) proxy addresses to access the Exchange mailboxes for migration. This option is available to Office 365 Enterprise customers and Office 365 Small Business customers.
IMAP migration
IMAP migration is targeted at customers who may be using non-Exchange-based mail systems in their current hosted environment or have access to the data only by using the IMAP 4 protocol. The Office 365 migration engine uses the information that’s provided by IT admins in the EAC to connect to IMAP mailboxes and download mailbox data. IT admins must provide a list of users to migrate in each batch by using a CSV file.
Offboarding migration
IT admins can move mailboxes from Exchange Online to a remote mailbox server by using the MRS Proxy service.
How to manage migration batches in Exchange Online
Admins whose organizations are deployed on Exchange Online can create and manage multiple migration batches by using the E-mail Migration wizard in the Exchange Admin Center by using Exchange Online PowerShell. Admins can “pre-stage” several migration batches for execution and can control when a migration batch is started. More than one migration batch can be run at one time.
How to create migration batches by using the E-mail Migration wizard in the Exchange Admin Center
To create a migration batch, follow these steps:
- Sign in to the Office 365 portal (https://portal.microsoftonline.com
(https://portal.microsoftonline.com/)
).
- Click Admin, and then click Exchange.
- Click Migration, click New (
Collapse this imageExpand this image
), and then click Onboarding.
- Select the migration option that you want, and then click Next. Migration options are as follows:
- Remote move
- Staged migration
- Cutover migration
- IMAP
The following screen shot shows the migration options:
Collapse this imageExpand this image
Remote move walkthrough
For more information about remote move, go to the following Microsoft TechNet website:
Staged migration walkthrough
To create a staged migration batch, follow these steps:
- Prepare a CSV file.
Each row in the CSV file that you use to migrate on-premises Exchange mailboxes to the cloud in a staged Exchange migration should contain information about the on-premises mailbox. For more information about the format and content of the CSV file, go to the following Microsoft website:
- On the “Select the mailboxes” screen, locate the CSV file that you created in step 1, and then click Next. The following screen shot shows an example:
Collapse this imageExpand this image
- Enter the credentials of your on-premises admin account, and then click Next. The following screen shot shows an example:
Collapse this imageExpand this image
- If the Autodiscover service can’t detect the connection settings for the on-premises Exchange server, you’re prompted to enter the following information:
- The fully qualified domain name (FQDN) of the Exchange server that hosts the mailbox that you’re migrating
- The FQDN of the proxy server for the Exchange server
If the Autodiscover service can detect the connection settings for the on-premises Exchange server, you’re prompted to confirm the entries. The following screen shot shows an example:
Collapse this imageExpand this image
Click Next.
- Enter a name for the migration batch, and then click Next.
Collapse this imageExpand this image
- Specify the admins in your Office 365 organization who should receive the migration report, select one of the following migration methods, and then click New:
- Automatically start the migration
- Manually start the migration later
Collapse this imageExpand this image
Cutover migration walkthrough
To create a cutover migration batch, follow these steps:
- Specify the Windows admin user account credentials for the Exchange server.
Collapse this imageExpand this image
- If the Autodiscover service can’t detect the connection settings for the on-premises Exchange server, you’re prompted to enter the following information:
- The FQDN of the Exchange server that hosts the mailboxes that you’re migrating
- The FQDN of the proxy server for the Exchange server
If the Autodiscover service can detect the connection settings for the on-premises Exchange server, you’re prompted to confirm the entries. The following screen shot shows an example:
Collapse this imageExpand this image
Click Next.
- Enter a name for the migration batch, and then click Next.
Collapse this imageExpand this image
- Specify the admins in your Office 365 organization who should receive the migration report, select one of the following migration methods, and then click New:
- Automatically start the migration
- Manually start the migration later
Collapse this imageExpand this image
IMAP migration – Walkthrough
To create an IMAP migration batch, follow these steps:
- Prepare a CSV file.
The CSV file that you use to migrate the content of user’s mailboxes should contain a row for each user. Each row contains information about the user’s cloud-based mailbox and IMAP mailbox that are used to process the migration. For more information about the format and content of the CSV file, go to the following Microsoft website:
- On the “Select the mailboxes” screen, locate the CSV file that you created in step 1, and then click Next. The following screen shot shows an example:
Collapse this imageExpand this image
- On the IMAP Configuration screen, enter the connection settings for the server from which you want to migrate mailbox data. The following screen shot shows an example:
Collapse this imageExpand this image
- Enter a name for the migration batch, and then click Next.
Collapse this imageExpand this image
- Specify the admins in your Office 365 organization who should receive the migration report, select one of the following migration methods, and then click New:
- Automatically start the migration
- Manually start the migration later
Collapse this imageExpand this image
How to manage migration batches by using the Exchange Admin Center
After admins create the migration batch, they can create additional migration batches. Additionally, admins can change, delete, pause, or start an existing migration batch. They can use the following controls to perform these actions:
Collapse this imageExpand this image
Admins can also change the associated endpoint of a migration batch by using controls on the Migration tab. If more than one batch is started, admins can select the migration batch that has the highest priority.
Collapse this imageExpand this image
Migration endpoints
Migration endpoints are management objects that describe the remote server information and connection settings that are associated with one or more batches. When you provide server information during a migration batch request, you’re actually creating a migration endpoint. After you create migration endpoints, you can assign them to new migration batches or pending migration batches.
The following screen shot shows migration endpoint properties that are accessed through migration batch properties:
Collapse this imageExpand this image
The following screen shot shows migration endpoint properties that are accessed from the More button on the Migration screen:
Collapse this imageExpand this image
How to manage migration batches by using Exchange Online PowerShell
Admins can use the following Exchange Online PowerShell cmdlets to manage migration batches:
- Complete-MigrationBatch
- Get-MigrationBatch
- Get-MigrationConfig
- Get-MigrationEndpoint
- Get-MigrationStatistics
- Get-MigrationUser
- Get-MigrationUserStatistics
- New-MigrationBatch
- New-MigrationEndpoint
- Remove-MigrationBatch
- Remove-MigrationEndpoint
- Remove-MigrationUser
- Set-MigrationBatch
- Set-MigrationEndpoint
- Start-MigrationBatch
- Stop-MigrationBatch
- Test-MigrationServerAvailability
For more information about how to use each cmdlet, run the Get-Help cmdlet.
How to monitor the status of the migration batch
Admins can view the current status of each migration batch in the Exchange Admin Center. To do this, they should select the migration batch on the Migration tab. The status information is as follows:
- Type: Migration type. Migration types are as follows:
- Remote move
- Staged migration
- Cutover migration
- IMAP
- Direction: Migration direction. Migration directions are as follows:
- Status: The current state of the migration batch that are selected. The status are as follows:
- Created
- Removing
- In Progress
- Completed
- Failed Mailboxes: The number of mailboxes for which the migration isn’t successful
- Created by: The mailbox address of the admin who created the migration batch
- Create Time: The date and time when the migration batch was created
- Start Time: The date and time when the migration batch was initiated
- Initial Sync Time: The date and time when the initial sync started
- Initial Sync Duration: The time that is taken to complete the initial sync
- Last Synced Time: The date and time when the last sync completed for the active users
Article ID: 2798131 – Last Review: May 15, 2013 – Revision: 7.0
| o365e o365p o365 o365a o365022013 after upgrade kbgraphxlink KB2798131 |
View the original here:
How to migrate mailbox data by using the Exchange Admin Center in Office 365
Error when you run the Remote Connectivity Analyzer tool to test connectivity to Office 365: "To authenticate to Office 365, you must enter your Microsoft account"
To authenticate to Office 365, you must enter your Microsoft account. This is your User Principal Name and in many cases will be something like user@contoso.com.
- You’re using an incorrect user name.
- Your password has expired.
- Your user account isn’t activated.
Collapse this tableExpand this table
| Cause | Resolution |
|---|---|
| You’re using an incorrect user name. | Enter your Office 365 user ID. Your Office 365 user ID is your user principal name (UPN). For example, enter jane@contoso.com.
If you don’t know your Office 365 user ID, contact the admin for help. |
| Your password has expired. | Contact the admin at your company to reset your password. For more information, see the following Microsoft Knowledge Base article:
2606983
(http://support.microsoft.com/kb/2606983/ An Office 365 user or an Office 365 administrator forgot his or her password For more information about how to reset a user’s password if you’re an admin, go to one of the following Microsoft websites: |
| Your user account isn’t activated. | To get started with Office 365, you have to activate your user account. To do this, sign in to the Office 365 portal (https://portal.microsoftonline.com
(https://portal.microsoftonline.com/) ) for the first time by using your temporary password, and then create a new password to use when you sign in. For more information, go to one of the following Microsoft websites: |
Article ID: 2768537 – Last Review: May 15, 2013 – Revision: 7.0
Applies to
- Microsoft Office 365 for enterprises (pre-upgrade)
- Microsoft Office 365 for small businesses (pre-upgrade)
- Microsoft Office 365 for education (pre-upgrade)
- Microsoft Exchange Online
| o365 o365e o365p o365a o365062011 pre-upgrade o365022013 after upgrade o365m KB2768537 |
How to add a disclaimer to email messages in Office 365
- Append a disclaimer so that the text appears at the end of email messages as a footer.
- Prepend a disclaimer so that the text appears at the beginning of email messages.
- Sign in to the Office 365 portal (http://portal.microsoftonline.com
(http://portal.microsoftonline.com/)
) as an administrator.
- In the header, click Admin, and then click Exchange to open the Exchange Administration Center.
- In the left navigation pane, click Mail Flow, and then click Rules.
- Click New, and then click More options on the new rule page.
- In the Name of rule box, type a name for the new rule.
- Under *If, select the conditions that must met for a message to include the disclaimer.
- Under *Do the following, point to Apply a disclaimer to the message, and then take one of the following actions:
- To add disclaimer text to the end of the message as a footer, click Append a disclaimer.
- To add disclaimer text to the beginning of the message, click Prepend a disclaimer.
- Click Enter text, and then type the disclaimer text that you want.
- Specify any other settings that you want for the rule.
- Click Select one, and then specify a fallback action to take if the rule can’t be applied.
- Under Choose a mode for this rule, click Enforce this rule.
- Click Save.
Article ID: 2750619 – Last Review: May 15, 2013 – Revision: 6.0
| o365e o365p o365a o365m o365022013 o365 after upgrade KB2750619 |
Read the original post:
How to add a disclaimer to email messages in Office 365
Error message when you connect an InfoPath form to a SharePoint Online web service: "An error occurred while connecting to a Web Service"
When you try to connect a Microsoft InfoPath form to a Microsoft SharePoint Online web service, you receive one of the following error messages:
An error occurred while connecting to a Web Service.
An error occurred querying a data source.
Any time that you make a call to the same server from an InfoPath form, the requests to loop back. This works only when loopback protection is disabled. For security reasons, loopback protection is always enabled in SharePoint Online. This is a known limitation of InfoPath forms in the Office 365 SharePoint Online environment, and there is no workaround for this issue.
Article ID: 2674193 – Last Review: May 15, 2013 – Revision: 8.0
Applies to
- Microsoft Office 365 for enterprises (pre-upgrade)
- Microsoft Office 365 for small businesses (pre-upgrade)
- Microsoft Office 365 for education (pre-upgrade)
- Microsoft SharePoint Online
- Microsoft InfoPath 2010
| o365e o365p o365a o365m o365062011 pre-upgrade o365 o365022013 after upgrade KB2674193 |
FAST ESP/ Unable to use Active Directory accounts for Authentication / Login Fails with LdapErr: DSID-0C0901FC
FAST ESP / Enable ESP Administrator to use Active Directory accounts for Authentication
http://support.microsoft.com/kb/2441205/en-us
(http://support.microsoft.com/kb/2441205/en-us)
One may still be unsuccessful to enable authentication against active directory from the ESP Administrator. Also, while attempting to logon the following error is recorded in the adminserver.log:
(ldap://dc.contoso.com:389/)
using com.sun.jndi.ldap.LdapCtxFactory as user FAST (http-15089-Processor22)
2011-04-25 17:22:15,114 DEBUG no.fast.vespa.security.auth.JaasLdapProvider: Authentication failed (http-15089-Processor22)
javax.naming.AuthenticationNotSupportedException: [LDAP: error code 8 – 00002028: LdapErr: DSID-0C0901FC, comment: The server requires binds to turn on integrity checking if SSLTLS are not already active on the connection, data 0, v1772
This policy on the domain controller is: “Domain controller: LDAP server signing requirements” and if set to “Require signing” the LDAP data-signing option must be negotiated unless Transport Layer Security/Secure Socket Layer (TLS/SSL) is being used. This also sets the following registry key on all domain controllers:
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesNTDSParametersLDAPServerIntegrity=2
If this policy is configured on one’s domain controllers in a Windows Domain, non-secure LDAP authentication will fail.
Method 1:
Change the policy “Domain controller: LDAP server signing requirements” on the Domain Controllers to “None” which will set the LDAP Data signing to not require in order to bind with the server. However, if the client requests data signing, the server supports it.
Setting this policy to “none” will also change the following registry setting on all DCs:
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesNTDSParametersLDAPServerIntegrity=1 (Note: This is the default setting)
Once this setting is changed on the DC, the ESP server should allow unsecured LDAP Authentication and the process in KB2441205 will allow authentication against Active Directory from the ESP Administrator.
Method 2:
Configure the ESP Adminserver process to bind securely with the LDAP server hosted by the Windows Domain Controller.
In order to accomplish this the following steps must be completed:
1. Obtain the Domain Controllers Self-Signed SSL Server Certificate.
Note: One can refer to the Windows security group to obtain the required certificate.
2. Once the appropriate certificate is obtained, one must install the certificate in the “Trusted Root Certification Authorities” Container on the FAST ESP Server.
3. Test the secure LDAP connection from the ESP Server using LDP.EXE.
See the following to obtain more information on obtaining and utilizing LDP.EXE:
Ldp Overview
http://technet.microsoft.com/en-us/library/cc772839(WS.10).aspx
(http://technet.microsoft.com/en-us/library/cc772839(WS.10).aspx)
4. Launch LDP.EXE from the FAST ESP Admin Server.
5. Choose “Connection” from the file menu.
6. Choose “Connect” from the drop down menu.
7. Type the name of the DC with which to establish a connection.
8. Change the port number to 636.
Note: 636 is the secure LDAP port (LDAPS)
9. Choose the checkbox “SSL” to enable an SSL connection.
10. Click “ok” to test the connection.
11. If successful, a secure LDAPS connection is established to the DC and validates the certificate that was installed in step 2.
12. At this point the Root CA SSL Certificate that was obtained in step 1, must be installed into the JAVA Key Store to ensure that the JAVA based ESP Adminserver component will be able to successfully establish a secure LDAP connection to the DC.
This step can be accomplished by using keytool that is shipped with JAVA:
Example:
$JAVA_HOME/bin/keytool -import -alias root -keystore $JAVA_HOME/lib/security/cacerts -trustcacerts -file
/ldap-server.cer
Note: The certificate is added to the default JVM truststore $JAVA_HOME/lib/security/cacerts, and added with the alias ‘root’.
See the following Information for assistance with this process:Importing a Certificate for the CA:
http://download.oracle.com/javase/1.3/docs/tooldocs/win32/keytool.html
(http://download.oracle.com/javase/1.3/docs/tooldocs/win32/keytool.html)
13. Once the DC Root Cert is successfully imported into he Java Keystore, open and edit the login.conf file in path: %FASTSEARCH%adminserverwebappsadminserverWEB-INFlogin.conf
14. Modify the existing entry:
LDAP
no.fast.vespa.security.auth.JaasLdapProvider required
providerURL="ldaps://gc1.contoso.com:636 "
principalFormat="0@contoso.coml (@contoso.coml) ";
Where ldaps://gc1.contoso.com:636
(ldaps://gc1.contoso.com:636/)
is the full LDAP URL to company’s LDAP server, and where @contoso.com is a common part of all user names.
Note: The difference in this setting compared with KB2441205 is the LDAP URL is being changed to “ldaps” and port “636” which is required to establish a secure ldap connection.
15. Edit the file %FASTSEARCH%adminserverwebappsadminserverWEB-INFclassesesp4j-security-context.xml.
16. Change the loginContextname property to LDAP on the bean with id id=”jaasAuthenticatorTarget“.
Note: The property specifies which login context to use. Changing this setting to LDAP will activate the login context specified in WEB-INFlogin.conf.
Example:
/WEB-INF/login.conf
LDAP
17. Restart Adminserver:
nctrl stop adminserver
nctrl start adminserver
18. Login to the admin node and navigate to FAST Home > User Administration > Create Users & Groups.
19. Create a user with the same name as the Windows user that requires access rights to ESP.
20. Select “This user will be authenticated by an external management system”.
21. Give this user rights in ESP, for example, choose “may create and delete users and groups (admin)“:
Note: If one chooses to authenticate a user by an external user management system, the User Name field must match the user login of the external user management system (AD User account in this case). It is not required to fill in the e-mail and password fields for users authenticated through an external user management system.
22. Once these changes are made, one can log into the ESP admin console with mapped external accounts that are maintained in the Windows Domain.
See the article here:
FAST ESP/ Unable to use Active Directory accounts for Authentication / Login Fails with LdapErr: DSID-0C0901FC
Recent Comments