Access Denied with Citrix WISP

I was attempting to install and activate the Citrix Web Interface for SharePoint on MOSS 2007 but was getting nowhere. The solutions appeared to add, deploy, and activate without error, but when I hit any of the Citrix administration links on the site collection root’s Site Settings page in the portal, all I received was 'Unknown Error.'

I had to first apply a registry hack to get the Citrix code to log anything that was going wrong. From its admin guide:

You can also find useful troubleshooting information in the log files stored in sharepoint\LOGS\LogFolder, where LogFolder is a location you can specify by setting a string value for LogFolder in the following registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\WISP.

Without creating this key, nothing is logged. After creating it, I could see a curious sequence of events when trying to activate the Citrix Access Core feature:

...
Adding List Item Event Receiver: Added
Adding List Item Event Receiver: Deleting
Adding List Item Event Receiver: Deleted
Elevating privilege, now running as DOMAIN\moss-pool-dev
Adding new configuration update job (ConfigUpdateJob-default-WIConfiguration(DMOSS01))
AddConfigurationUpdateJob() Error: Access denied.
at Microsoft.SharePoint.Administration.SPPersistedObject.Update()
at Microsoft.SharePoint.Administration.SPJobDefinition.Update()
at Citrix.WISP.Configuration.Jobs.UpdateJob..ctor(String jobName, SPSite site, SPServer server, String configurationName, String configurationType, String filename, List`1 featureIds, SPJobLockType targetType)
at Citrix.WISP.Configuration.Jobs.Installer.<>c__DisplayClass2.b__0()
End of Elevating privilege, now running as DOMAIN\apenn
Adding new job CitrixAccessCoreDeployment(DMOSS01)(Citrix Access Core Service Provider Deployment) to DMOSS01(Application)
AddDeploymentJob() Error: Access denied.
at Microsoft.SharePoint.Administration.SPPersistedObject.Update()
at Microsoft.SharePoint.Administration.SPJobDefinition.Update()
at Citrix.WISP.AccessCore.Jobs.DeploymentJob..ctor(String jobName, SPSite site, SPServer server, SPJobLockType targetType, String title)
at Citrix.WISP.AccessCore.Jobs.Installer.<>c__DisplayClass2.b__0()
Updating Property Citrix.WISP.Site.Active in site https://devextranet.DOMAIN.local with value True
CitrixContentRedirectionModule: Add the web.config mod
- SPWebApp Name: Customer Extranet
- add/remove here: configuration/system.web/compilation/expressionBuilders
- the following:
CitrixAccessCore::Activate Error: Access to the path 'C:\Inetpub\wwwroot\wss\VirtualDirectories\devextranet.DOMAIN.local80\web.config' is denied.
at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
at System.IO.FileStream.Init(String path, FileMode mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32 bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath, Boolean bFromProxy)
at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share)
at System.Xml.XmlDocument.Save(String filename)
at Microsoft.SharePoint.Administration.SPWebApplication.ApplyWebConfigModifications()
at Microsoft.SharePoint.Administration.SPWebService.ApplyWebConfigModifications()
at Citrix.WISP.AccessCore.FeatureReceiver.<>c__DisplayClass2.b__0()
at Microsoft.SharePoint.SPSecurity.CodeToRunElevatedWrapper(Object state)
at Microsoft.SharePoint.SPSecurity.<>c__DisplayClass4.b__2()
at Microsoft.SharePoint.Utilities.SecurityContext.RunAsProcess(CodeToRunElevated secureCode)
at Microsoft.SharePoint.SPSecurity.RunWithElevatedPrivileges(WaitCallback secureCode, Object param)
at Microsoft.SharePoint.SPSecurity.RunWithElevatedPrivileges(CodeToRunElevated secureCode)
at Citrix.WISP.AccessCore.FeatureReceiver.changeExpressionBuilderInWebConfig(SPWebApplication app, Boolean remove)
at Citrix.WISP.AccessCore.FeatureReceiver.FeatureActivated(SPFeatureReceiverProperties properties)
CitrixAccessCore: Ended at Monday, March 24, 2008 9:51:03 AM

It was apparent it was trying to take some actions under the application pool identity for the web application which failed with 'access denied,' and then was trying to use MY account (a domain administrator, MOSS farm administrator, and local MOSS server administrator) for other actions and STILL getting 'access denied!'

The administrator's guide for WISP does state:

To complete the installation you must have server farm administrator permissions, meaning you must be a member of the
administrators group on each of your Web and Application servers, and SQL security administrator with database creator rights on each of your SQL servers.

Those rights my account had; however, to correct the 'access denied' problem, I had to make my APPLICATION POOL IDENTITY:

• A member of the Farm Administrators group in MOSS; and
• A local machine administrator on the MOSS server.

C'mon Citrix, the application pool identity is supposed to be a low-privileged account.

Ubuntu rkhunter configuration

I recently added rkhunter, a rootkit detection utility, to my Ubuntu installation. After doing so, I started picking up warnings from cron during its daily scan:

Warning: Found enabled inetd service: /usr/sbin/vmware-authd
Warning: Hidden directory found: /etc/.java
Warning: Hidden directory found: /dev/.static
Warning: Hidden directory found: /dev/.udev
Warning: Hidden directory found: /dev/.initramfs
Warning: Hidden file found: /dev/.tmp-2-0: block special (2/0)

Research indicates that these particular warnings are spurious--I know I have VMware running, and the others seem to be facets of the way Ubuntu is constructed. To suppress them, I added the following lines to /etc/rkhunter.conf:

ALLOWHIDDENDIR=/etc/.java
ALLOWHIDDENDIR=/dev/.static
ALLOWHIDDENDIR=/dev/.udev
ALLOWHIDDENDIR=/dev/.initramfs
ALLOWHIDDENFILE=/dev/.tmp-2-0
INETD_ALLOWED_SVC=/usr/sbin/vmware-authd

MOSS audiences and missing AD groups

I had a problem where I was trying to construct audiences in MOSS with members based on certain Active Directory groups, but I had a handful of groups that did not appear in the "browse" dialog on the Add Audience Rule page. It turns out these groups were empty, and that the group list is populated by reading the groups each user is a member of during the profile import. This dialog does NOT contact AD.

I added an account to the groups in question and repeated the profile import. Voila--the groups appeared in the browse dialog.

Zenoss Core web site (Zope application server) crash

We had two Zenoss winexe processes go out of control yesterday. They consumed all available CPU and RAM and caused the rest of the daemons to crash/slow down. When we restarted Zenoss ("zenoss stop" followed by "zenoss start"), all Zenoss daemons came up, but zopectl (the Zope application server daemon) immediately died.

We found several of the following errors in $ZENHOME/log/event.log that appeared to be related:

2008-01-09T10:15:36 ERROR Zope.SiteErrorLog http://server.domain.local:8080/zport/RenderServer/render
Traceback (most recent call last):
File "usr/local/zenoss/lib/python/Zope2/App/startup.py", line 167, in zpublisher_exception_hook
File "usr/local/zenoss/lib/python/ZPublisher/Publish.py", line 120, in publish
File "usr/local/zenoss/lib/python/Zope2/App/startup.py", line 233, in commit
File "usr/local/zenoss/lib/python/transaction/_manager.py", line 84, in commit
File "usr/local/zenoss/lib/python/transaction/_transaction.py", line 381, in commit
File "usr/local/zenoss/lib/python/transaction/_transaction.py", line 379, in commit
File "usr/local/zenoss/lib/python/transaction/_transaction.py", line 424, in _commitResources
File "usr/local/zenoss/lib/python/ZODB/Connection.py", line 462, in commit
File "usr/local/zenoss/lib/python/ZODB/Connection.py", line 495, in _commit
ConflictError: database conflict error (oid 0x3b, class Products.ZenUtils.PObjectCache.PObjectCache)

Remediation:

1. Make sure zeoctl is started (as zenoss, "zeoctl start" followed by a few seconds pause and then "zenoss status" to confirm it has a PID and is running).
2. cd $ZENHOME/var
3. rm *.zec (this deletes invalid cache files that are causing the above error)
4. zopectl start
5. Wait a few seconds, then check if Zope stays running (use "zenoss status" or just hit the website to confirm).

WSS/MOSS SP1 application caused DCOM activation error

I applied the WSS 3.0 SP1 and MOSS SP1 to one of my MOSS installations and started getting the following errors:

Application Log
Event Source: Office SharePoint Server
Event Category: Office Server Shared Services
Event ID: 6482

The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{3D42CCB1-4665-4620-92A3-478F47389230}
to the user HCHB\moss-svc-prd SID (S-1-5-21-796845957-484763869-839522115-12856). This security permission can be modified using the Component Services administrative tool.

System Log
Event Source: DCOM
Event Category: None
Event ID: 10016

The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{3D42CCB1-4665-4620-92A3-478F47389230}
to the user HCHB\moss-svc-prd SID (S-1-5-21-796845957-484763869-839522115-12856). This security permission can be modified using the Component Services administrative tool.

I tracked down these class IDs and it turns out they belong to the OSearch DCOM application. I swear, I wish in this modern era that MOSS didn't use DCOM. To fix this, verify that your primary MOSS service account is in the Distributed COM Users group on the MOSS server. Then, in dcomcnfg, locate the OSearch application and choose Properties.

On the Security tab, click Edit on the Launch and Activation Permissions area and add the Distributed COM Users group to the ACL. Check both the Local Launch and Local Activation for this group. Restart OSearch (net stop osearch followed by net start osearch at a command prompt) and that should fix the problem.

WQL Queries Fail Against Valid Performance Counters

I was trying to run WQL queries against remote Windows systems to read things such as the current IIS connections. The query looks like the following:

SELECT CurrentConnections FROM Win32_PerfFormattedData_W3SVC_WebService

I kept getting an 0x80041010 ("Invalid Class") error from the remote DCOM objects even though the performance objects clearly were visible and monitorable in perfmon. This error code means that either:

- You are trying to query a non-existant performance object;
- The performance object exists and has not been registered; or
- The performance object is not registered properly.

I went through a number of troubleshooting steps, including jacking around with dcomcnfg (launch/activation permissions, default authentication levels), re-registering performance counter DLLs, etc. and nothing helped. Finally, executing the following command on the target servers proved to be the key:

winmgmt /clearadap (thanks to this site for advising about this clear command)
winmgmt /resyncperf

This tool fixes invalid registry entries around the performance DLLs and fixed all of my WQL problems.

Some other steps that may help:

If the performance objects haven't been registered, install the Windows Server Support Tools, and run exctrlst. This tool allows you to uncheck and re-check the registered performance objects and may help with the above. If you use this tool on any classes, follow the execution with a call to winmgmt as above.

To rebuild all Performance counters including extensible and third party counters in Windows Server 2003, type the following commands at a command prompt. Press ENTER after each command.

cd \%windir%\system32
lodctr /R

Additional WMI Troubleshooting Resources

WMI Troubleshooting (MSDN)

WMI Isn't Working! (TechNet--good troubleshooting tips)

Scriptomatic 2.0: This tool shows you a list of all registered WMI classes on the machine with the WQL format class names.

WMI Explorer: Another good tool for exploring registered WMI classes.

GnuCash 2.2 on Ubuntu Gutsy - with OFX Direct Connect!

When I started running Ubuntu Gutsy (7.10) about a month and a half ahead of its release this week, its GnuCash package was still in the 2.0 series, and I wanted to run 2.2. While 2.2 is now in the official repositories, I understand that a licensing issue prevents the Ubuntu GnuCash package from shipping with OFX Direct Connect enabled (it will import qfx/ofx files but not connect directly to financial institutions to retrieve transactions, as one of mine requires). So, with both of these goals in mind, I set out to build my own GnuCash 2.2 with OFX Direct Connect. Unfortunately, this process is not for the average user...

Building GnuCash

First, get a terminal open and install all the dependencies for this process:

sudo aptitude install libktoblzcheck1-dev libqt3-mt-dev libofx-dev libxml2-dev libgconf2-dev guile-1.6-slib guile-1.6-dev libglib2.0-dev libgtk2.0-dev libgnomeui-dev libgoffice-0-dev libgtkhtml3.8-dev libgwenhywfar38-dev slib gettext devscripts build-essential

Whew! Now we need to build libchipcard3-3.0.3, a dependency of the aqbanking library we will build later. This has no dependencies. For the uninitiated, this process consists of unpacking the archive and then executing the following in a terminal:

cd [folder in which you unpacked libchipcard]
./configure
make
sudo make install

That done, we build aqbanking 2.3.2. This is similar to building libchipcard above, but you have to pass some arguments when running the configure step:

./configure --with-frontends="cbanking g2banking qbanking"

Now download and unpack the latest GnuCash 2.2 source. You are looking for the latest archive starting with just "gnucash." Go through the same process again, except do the following for the configure step:

./configure --enable-ofx --enable-hbci

Configuring OFX Direct Connect

That's it--once you are done, you should have a shiny installed GnuCash 2.2 with OFX Direct Connect support (you will have an Actions > Online Actions menu). Next comes the frustrating process of figuring out how to connect to your bank! This is where applications like Quicken and Microsoft Money have done the hard work for you and baked in all these details. Unfortunately, it is somewhat difficult to find out the parameters you need to pass from the Direct Connect interface to get a successful download. The GnuCash wiki has a nice article that details some of the settings and contains instructions for downloading a script that will pull down the raw information about thousands of financial institutions. Follow these instructions to get the configuration information about your bank.

Add a User

Once you have this done and have located the details for your financial institution, in GnuCash, go to Tools > Online Banking Setup. The Online Banking Setup Wizard will launch. Click the Forward button until you see the button labeled Start Aqbanking Wizard, and click it. In the AqBanking Wizard, go to the Users tab and click New.

Here's where the guesswork begins. Many fields exist in the wizard that may or may not be used by your particular institution. For example, for Charles Schwab, I put my online login (user) name in all three of the User name, User Id, and Customer Id fields. If you are downloading transactions from a bank account, put your bank's ABA routing number (the number at the bottom left of your checks) in the Bank Id field, and specify the country of your bank. For my credit card, I did specify the country, but put arbitrary text in the Bank Id field (I probably could have left it blank).

Now let's move on to the OFX tab. Using the information downloaded about your financial institution, enter any of the FID, ORG, and Broker Id values that the institution is using (there will be values for those nodes in the downloaded XML file). Put the OFX server URL in the Server URL field in its complete https:// format. It doesn't seem to matter if you specify HTTP 1.0 or 1.1, and in fact with the version of the code I compiled, it always saves it as 1.0 regardless of what I do.

For the checkboxes at the bottom, typically just check the following and then click the Get Accounts button:

• Supports Account List Download
• Supports Statement Download
• (and, if a credit card) Send Empty Bank Id
  

You will be prompted for your password, and then it should pull down all the settings for the account(s) you have at that institution under the Accounts tab. You may wish to review what it downloaded and poke around in these settings, but I can't give any specific advice.

Downloading Transactions

Once you have set up your institutions and accounts, you are ready to download. NOTE: some institutions (like Chase) have a setting in your online (not GnuCash) account configuration to enable OFX download before any of this will work. To get your transactions, open the account in GnuCash and click Actions > Online Actions > Get Transactions. When downloading for the first time, you may be prompted to accept the SSL certificate of the site, and you WILL be prompted to associate the GnuCash account with the OFX account you set up. Once you have done this, for subsequent downloads, just open the GnuCash account, go to the Get Transactions as above, and key in your password (the application does not store passwords).

I hope this helps someone. While not for the faint of heart, it IS possible to have GnuCash downloading transactions directly from your bank/credit card company without any intervening file downloads.