ECTS - Couple of problems

Question

Hello,

Have deployed ECTS on a WSS sharepoint server.

1. When trying to add an external user, get the following error:
Unable to establish secure connection with the server (C:\Inetpub\wwwroot\wss\VirtualDirectories\80\web.config line 133)
Also, when trying to login from the extranet address, get the following error
Unable to establish secure connection with the server (C:\Inetpub\wwwroot\wss\VirtualDirectories\extranet.site.org443\web.config line 133) [i have replaced the domain name with 'site']

2. Secondly, the ECTS webparts do NOT show up in the webpart gallery. I have checked and they are deployed to the web application in central administration although do not show up in the Site Features page on the Site Settings.

Any ideas of either problem,

thanks.

Answer 1

Hello,

 

Sorry to state the obvious, but this is almost certainly because you didn't follow the documentation *exactly*.

 

I suggest you start over with a clean box and try again.

 

Sorry,

Dave

 

Answer 2

 

David,

 

I followed the steps as directed in the ECTS setup to both a SQL 2005 server and using SQLExpress on the WSS server.

I still get the same error when trying to add an external user.

 

My environment consists of one Windows Server 2003 WFE server that is running WSS 3.0. I have an external Windows Server running SQL 2005. I created a WSS internal site and extended it to a site using SSL. I applied the SSL cert to the extended site and applied the same cert to the my WSS server (this is hosting ADAM). I then updated the permissions on the SSL cert following the instructions. I tried setting up the ECTS to use our SQL server and received errors when setting up the database. I then had our DB admin run the database script on the server and was able to create the ADAM instance and Sharepoint. I get all of our webparts but when I try adding an external user, I get the error message:Unable to establish secure connection with the server (C:\Inetpub\wwwroot\wss\VirtualDirectories\wssts1.ifas.ufl.edu80\web.config line 133) .

 

I then tried removing everything and going through the process again using SQLExpress on my WSS server. Running the scripts I get everything saying it was setup successfully (ADAM, database & Sharepoint). However, I get the same error message again when trying to add external users. 

 

I know I am sounding stupid, but even our DBAdmin does not know why this is not working.

Do you need more info or can you tell me where I may have gone wrong? 

Answer 3

I just set up a new ECTS scenario and have gone through 3 times now and have the same result when adding a new external user:

 

Unable to establish secure connection with the server (C:\Inetpub\wwwroot\wss\VirtualDirectories\extranet80\web.config line 191) 

 

I ripped out all ADAM instances, ADAM itself, removed the ECTS completely, and started from scratch.  I have a single server that hosts ADAM, Web, and App services with a second dedicated SQL server.  Both servers are members of an AD domain.

 

Not sure really where to look to troubleshoot other than trying to parse the web.config.  Lot's of ASP.Net results when searching for the error that deal with AD authentication providers but tough to see the correllations.

Answer 4

Did you try this:

Update Permissions on the Certificate File

To do so, access the C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys folder. One of the keys in this folder will be the key you just installed. Check the time stamp to find the appropriate key, or you can use the certutil ‑store my command to help locate the appropriate key (the key container is the file name of the key file).

To update permissions on the certificate:

1.     Right-click the appropriate key file, and then click Properties.

2.     Click the Security tab, and then click the Add button.

3.     Click the Locations button, and then, in the Locations list, click the name of the extranet server, and then click OK.

4.     In the object names text box, type Network Service, click the Check Names button to resolve the name, and then click OK to continue.

5.     Under Permissions for NETWORK SERVICE, verify that the check boxes to Allow the Read and Read & Execute permissions are selected and then click OK.

ADAM will now be able to read the key file and use the certificate.

 

The reason this has to be done is because  the Adam server can't  read the certificate unless you give permissons to do so.

Answer 5

Hi,

 

This is not a solution to this problem but instead of creating another thread just putting it here.

 

I have tried to use ECTS for collaboration on MOSS 2007, but instead of ADAM I am using AspNetSqlMembershipProvider. Please guide me if anybody has installed ECTS which stores user information on AspNetSqlMembershipProvider.

 

Thanks & Regards,

Heeren Pandya

Answer 6

Also be interested to hear if you can use ECTS against AD.  We already have an external AD and don't really want to go through the process of migrating to ADAM (mainly because we'd have to reset everyones password).

Answer 7

Did you solve this?

 

I have the same problem. I alsow get the message "Unable to establish secure connection with the server" when adding external users.

Answer 8

I was able to talk with Dave Mowers at Tech-Ed 2008 in Orlando after one of his presentations. He stated he did not know why the ECTS did not work (obviously, because he has no hands-on with my system), asked about the permissions issue for Network Service. I explained everything I had done, following his procedure step-by-step - including SSL and permissions on service accounts.

In his presentation he explained they set their environment up on a fresh install of Sharepoint, but that they felt the solution would work on existing implementations. Luis Martinez from Microsoft was there as well. They said they were not aware of any problems when installing on existing Sharepoints.

I was able to talk with one attendee who said he was successful at setting it up in his environment, but instead of using ADAM he was using a secondary AD structure. 

 

I tried again on mine (every step) but to no avail. My next effort will be to re-create my WSS 3.0 and establish a medium farm. However, I will be using Windows Server 2008 Longhorn for my web front-ends and search server, so we'll see if that improves anything. I will have two WFE's, one search (all virtual servers on an a VMWare ESX box) and one DB server (physical) running SQL 2005. After the farm is initially set, before I migrate any content, I am going to try to re-deploy the ECTS kit on my farm. If it works, that will fix my problem. If it does not, I will use the piece-meal Collaboration I setup.

 

I don't want to, the ECTS looks so much nicer. But to this point, I have no alternative. Sharepoint Solutions offers an ECTS tool but that is a cost we cannot afford at this time.

But, I just realized I did not ask what virtual server they used when setting their ECTS environment up. Obviously it should have been virtual Windows Server 2003, but I am curious what hardware the virtual server was running on.

Answer 9

Hello Everyone,

 

Sorry for the long delay in responding, but I've been travelling for the last several weeks.

 

I've read all the posts and it is very troubling to see all the problems that folks are having with installing and running the solution. We are definitely committed to making this solution work for everyone, so I would like whoever is having problems to contact me offline. My e-mail address is available from my user profile.

 

Hopefully we can make progress.

 

Also, I'll fully describe our typical development and test environment:

 

A single machine, usually 32bit Windows XP or Vista, running on anything from my laptop to one of several "regular" desktop systems. Our virtual environments are almost exclusively running on VPC 2007, although I think our test lab used Virtual Server at one point.

 

My development environment is 3x Windows Server 2003 R2 with each running the following:

 

• Domain Controller + Exchange 2007
• ADAM
• Windows SharePoint Services

We have tested on other configurations as well, but the above is what we've done most typically on the development side.

 

Talk to some of you again soon.

 

Dave

Answer 10

 

Hi David,
 
Seem I'm one of the sharepoint newbie that always hit errors when playing with MOSS. okay, so far i had try to install the ECTS on my standalone MOSS server
 
I have install the ECTS and ADAM on the machine for TESTING
 
STEPS
1. create WA -> port80
2. extend WA --> port 19920 for external site( seem i saw on the forum to put another port instead of 80)
3. create site collection
4. change the authentication provider for external site to form authentication. (ADAMUser) --> login screen appeared whenever browse to this page (mean it working right?)
 
5. Run the ECTS wizard and i got this
    ADAM setup failed
    SQL -->OK
    SharePoint --> OK
6. then i run a cmd script to create the instance cscript ects_setup_adam.vbs ECTSSITES 80 19920
    and it failed too
 
 

Answer 11

I don't think the parameters are right for setup_adam. You should have a container name that looks something like a DN, for example, "CN=ExternalUsers,DC=Corp,DC=Woodgrove,DC=com". ECTSSITES won't cut it

 

Dave

 

Answer 12

 

David,

 

I managed to run the ECTS wizard succesfully for those 3 item.. and it after i removed all the ADAM instance and redeployed the ECTS solutuion..

 

but again...after happy for a 5 minute..then i received an error which i can't add external user . below are the error

Unable to establish secure connection with the server (C:\Inetpub\wwwroot\wss\VirtualDirectories\externaletc80\web.config line 191)

seem like everyone have this error..but how to fix it? please give me a point

Answer 13

 

Sorry, but I'm not exactly sure I understand what the problem is. Unable to establish secure connection usually means that you skipped something in the SSL setup for ADAM. Can you use LDP to bind to ADAM?

Answer 14

 

yeah.. I dont use the SSL instead my external site is also using the port80.

i follow the documentation said that so..

 

what do you mean LDP to bind to ADAM?

Answer 15

I don't mean SSL to the webserver, that's a different topic and is optional as the guide states.

 

SSL setup for ADAM is *not* optional, however, and I suggest you read over the sections of the guide that talk about setting up ADAM again and make sure you have followed the required steps of getting a certificate and making sure ADAM has access to the private key file.

 

Dave

Answer 16

 

HI, Thanks for the info..

 

unfortunately the Certificate already installed on my server. and seem the error still same. is there any work around for this..

 

really appreciate your help David

Answer 17

Hi,

 

I still facing the same error eventhough i completely resetup the ECTS. and configured the SSL certificate as well.

all the ADAM,SQL and SharePoint successfully setup.

 

Setup

Internal URL = http://ects

Port:80

Authentication mode:Window

 

External URL = http://excternalects (extended)

Port:80

Authentication mode : Form ( ADAMUser)

 

whenever i add external user to the http://ects . I will this error "Unable to establish secure connection with the server (C:\Inetpub\wwwroot\wss\VirtualDirectories\ectssite80\web.config line 191)"

 

and i dont find the " Click here to register the external user's email address" . Where can i find this?

 

Please help me

 

 

 

Answer 18

Hello, I was getting these errors.

I'm trying to get this working on a single box, windows server 2008, MOSS 2007 SP1.

Firstly, in ects_setup_adam.vbs it looks for LFIDFE.exe in (windir)\adam\, on server 2008 this is in (windir)\system32\ so either change the relevant line to
    strLDIFDE =  objFSO.BuildPath(colProcessEnvVars("windir"), "\system32\ldifde.exe")
or copy it into windows\adam

I had nightmares getting the certificates bit right and connecting to ADAM/AD LDS over SSL. Using a stand-alone Certificate Authority on server 2008 I can't use a template and I couldn't get the FQDN of the server into the subject property of the certificate using the web certificate request app, I ended up creating and installing the certificate using the instructions here: http://go.microsoft.com/fwlink/?LinkID=15129 

Now, people keep going on about permissions on the certificates file, it's not very straight forward. This page http://blogs.technet.com/askds/archive/2008/03/13/troubleshooting-ldap-over-ssl.aspx was helpful.

If the service is running under Network Service then we will need to give the account access to the private key container.

To locate the private key container for a certificate, run the following command:

Certutil –V –Verifystore MY 0

Look for the following section in the output:

CERT_KEY_PROV_INFO_PROP_ID(2):   Key Container = e08a8f744d85c46b5494c876e5a9c7c2_17012b00-a428-4a32-bb81-3d15f8bc3c10   Provider = Microsoft RSA SChannel Cryptographic Provider   ProviderType = c   Flags = 60   KeySpec = 1

This key container value, “e08a8f744d85c46b5494c876e5a9c7c2_17012b00-a428-4a32-bb81-3d15f8bc3c10” is the private key container file you're looking for.

So you need to explicitly give the Network Service account read/read + execute permissions to this file, giving permissions to the whole folder doesn't work. Again, on Server 2008, things are a bit different and you'll find the keys in C:\Users\All Users\Microsoft\Crypto\RSA\MachineKeys.

This resolved all the problems I was having, now I'm stuck on adding an external user, when I click on "click here to register" i get "General access denied error."

Still, that's a lot further than I was getting this morning and hopefully what i've found might help others getting over the ADAM/AD LDS + SSL nightmares.

-Dan

Answer 19

Just went through this myself. One thing that that doesn't appear to be covered in the article about setting up ADAM/LDAP/SSL, or in the ECTS docs, is that root certificate, and where it goes.

On the ADAM server, it needs to be in the MY Store of the user running ADAM, as well as in the certificate store for the service itself (along with the actual certificate).

On the Sharepoint server(s), the root certificate that signed the SSL cert for the ADAM server also needs to be installed. I just use the certificates MMC snap-in to grab this from the issuing server, and put it in 1) the Computer certificate store, 2) the MY certificate store for the user running the Sharepoint service/web app pool, and 3) just for kicks, the WWW publishing service.

Give it a few minutes for this to all percolate around, then try it again.

So, this needs to go in:

Certificates - Current User (while logged in as the domain account for this app's app pool) - Trusted Root Certification Authorities - Certificates
Certificates (Local Computer) - [Same place]
Certificates - Service (World Wide Web Publishing Service) - [Same place]

Answer 20

 Hi all, i have some information that may be of assistance if you're still having trouble -

http://blog.henryong.com/2008/07/30/major-headbanging-with-wssv3-extranet-collaboration-toolkit-on-windows-server-2008/

---

http://www.henryong.com

Answer 21

Not much action on this thread lately, but running into similar issues:

2003 x64 standard, 2005 SQL, WSS 3.0

Getting the "unable to establish secure connection with server" error, web.config line 133 - which involves the connectionstring for ADAM.

I can get everything to work except the above error.  At this point I also cannot connect to the server via LDP using port 646 and SSL. 

On re-install, before adding ECTS but after installing ADAM I can connect to the server via port 646 and ssl on a test instance.  I remove the test instance, install ECTS and still get the above error as well as cannot connect via ldp to 636.

The referenced lines (133) of the error are below:

Line 133 of web.config from intranet80 starts with <add name="ADAMUser" type=

<membership defaultProvider="ADAMUser">
      <providers>
        <clear />
        <add name="ADAMUser" type="System.Web.Security.ActiveDirectoryMembershipProvider, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" connectionStringName="ADAMConnectionString" attributeMapUsername="userPrincipalName" requiresQuestionAndAnswer="true" enablePasswordReset="true" attributeMapPasswordQuestion="eatmuPasswordQuestion" attributeMapPasswordAnswer="eatmuPasswordAnswer" attributeMapFailedPasswordAnswerCount="eatmuFPAC" attributeMapFailedPasswordAnswerTime="eatmuFPAT" attributeMapFailedPasswordAnswerLockoutTime="eatmuFPALT" />
      </providers>
    </membership>
  </system.web>
  <runtime>
    <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">
      <dependentAssembly>
        <assemblyIdentity name="Microsoft.SharePoint" publicKeyToken="71e9bce111e9429c" culture="neutral" />
        <bindingRedirect oldVersion="11.0.0.0" newVersion="12.0.0.0" />
      </dependentAssembly>
      <dependentAssembly>
        <assemblyIdentity name="Microsoft.SharePoint.Dsp" publicKeyToken="71e9bce111e9429c" culture="neutral" />
        <bindingRedirect oldVersion="11.0.0.0" newVersion="12.0.0.0" />

The referred to connection string is:

  <connectionStrings>
    <add name="ADAMConnectionString" connectionString="LDAP://server:636/CN=Users,CN=externalusers,DC=portal,DC=domain,DC=com" />
    <add name="DBConnectionString" connectionString="Data Source=server\sharepoint; Database=ECTS; Integrated Security=SSPI" />
  </connectionStrings>


line 133 of web.config from extranet443 starts the same

    <membership defaultProvider="ADAMUser">
      <providers>
        <clear />
        <add name="ADAMUser" type="System.Web.Security.ActiveDirectoryMembershipProvider, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" connectionStringName="ADAMConnectionString" attributeMapUsername="userPrincipalName" requiresQuestionAndAnswer="true" enablePasswordReset="true" attributeMapPasswordQuestion="eatmuPasswordQuestion" attributeMapPasswordAnswer="eatmuPasswordAnswer" attributeMapFailedPasswordAnswerCount="eatmuFPAC" attributeMapFailedPasswordAnswerTime="eatmuFPAT" attributeMapFailedPasswordAnswerLockoutTime="eatmuFPALT" />
      </providers>
    </membership>
  </system.web>
  <runtime>
    <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">
      <dependentAssembly>
        <assemblyIdentity name="Microsoft.SharePoint" publicKeyToken="71e9bce111e9429c" culture="neutral" />
        <bindingRedirect oldVersion="11.0.0.0" newVersion="12.0.0.0" />

The referred to connection string is:

  <connectionStrings>
    <add name="ADAMConnectionString" connectionString="LDAP://server:636/CN=Users,CN=externalusers,DC=portal,DC=domain,DC=com" />
    <add name="DBConnectionString" connectionString="Data Source=server\sharepoint; Database=ECTS; Integrated Security=SSPI" />
  </connectionStrings>

Answer 22

I think when I had this issue it turned out that I needed an extra certificate installed on my extranet box (where I also have ADAM installed).  I already have the the 3rd party certificate installed for Extranet.parative.com but could not get a secure connection to adam.

To get around this I used the DC certsrv to request a new certificate.  The name on the cert must be the fqdn of the extranet server (or wherever you have ADAM installed) eg vm-test.domain.com.  To run through the cert process verbatim, follow the deployment guide.

Re-run the adam ects setup again and make create your container "CN=externalUsers,DC=domain,DC=com" The last part of the addresss here should be the same as your internally issued cert name (as above). Specify port 389 and 636.

Run ldp with connection string vm-test.domain.com, 636 SSL selected.  You should get a clear connection.  If you do not then you have done something wrong with you certificate or ECTS Adam install.

This should hopefully fix your issue.

Lloyd

Answer 23

I'm unsure what my original error was, but I fixed my issue at least.  Had nothing to do with the web.config and everything to do with certs.

I initially opened a ticket with a microsoft directory services group and they couldn't fix the problem.   Escalated to a senior guy and he fixed the problem by removing a copy of the certificate that the first group had me place in the service account store.  The first group futzed with the certificates all over the place, eventually it came back to the single certificate located in the local computer store a la the deployment guide.  Since that was my first position, I'm unsure what my initial issue was.  This was also my second setup of a CA and about the 5th version of the certificate used, so I'm assuming that I messed something up with my initial setup, re-set it up correctly yet via support placed a copy in the service store and via removal fixed it.

I also was unsure if after the uninstall something may be left over so I changed ports to 2000,2001 instead of 389,636.   Not really sure.

Now I can ldp over 2001 and hit my external site over https.  I'm now faced with the issue of the site hanging whenever i try to change something - people and groups, site creation, etc.  It just sits there trying to load..argh.

Answer 24

I really think this has to do with a Root Certificate issue, but I spent half a day trying to solve it and then just ended up making my Extranet Server a temporary CA.  Issuing the certificate to itself and everything worked great.  In order to do that you will need to stop your sharepoint site running under Port 80 and start your default website as the Web Based Certificate Service will be installed there.  Once the certificate gets installed you can stop the default website again and start your sharepoint site running on Port 80.  Hope this helps someone.

Answer 25

I was able to successfully configure ECTS on my VM and documented the steps with the list of gotchas here for future reference.