in

SharePoint Blogs

The Best Place for SharePoint-related Blogs

Michael Hofer - SharePoint Blog

Michael Hofer's blog about adventures in SharePoint land, including tips and tricks for all products and technologies used in Information Worker solutions.

Sharepoint cannot authenticate to ISA Server - Resolved: Kerberos needed

This gave and gives me a hard time! Imagine MOSS 2007 running in a corporate intranet. Your requirement is to connect to datasources on the internet. There are various scenarios, the most common are to

  • Consume RSS Feeds using the RSSFeed webpart
  • Consume a WebService or Server-Side Script using the SharePoint Designer DataView Webpart

When using the DataView WebPart, you'll get the following error message when trying to show the data from the internet source:

“The server returned a non-specific error when trying to get data from the data source. …”

 

When connecting using the RSSFeed Webpart, the error message will be even less saying...

 

OK, what can we do? Make sure that you've set the proxy in the web.config of your SharePoint Site Collection, as documented by Microsoft here: http://support.microsoft.com/kb/923173

 

However, this might still not do the trick! The DataView WebPart still shows the same error message. However, the RSSFeed Webpart is this time a little bit more specific:

 

“ProxyAuthenticationRequired (The ISA Server requires authorization to fulfill the request…)"

 

So wat is the problem? It seems (and some other bloggers mentioned this explicitely) that SharePoint doesn not authenticate itself towards the ISA Server! The only solution to this problem is to allow requests from all the IP addresses of all SharePoint WFE Servers to pass through ISA! (wheew, I hear your customers start to question you louder than normal - at least this is what happened here ;))

 

Well, this is what I know so far and granting all requests of my SharePoint WFE's to pass through works just perfectly. I'll try to investigate in this a bit more internally and make sure that MOSS server-side authentication is included in Office 14...

 

UPDATE: This is a double-hop problem! If you use Kerberos authenticaion, there is no problem! Thanks smyttie!!!

 

Hope this helps some of you to save a lot of valuable time...

 

Comments

 

smyttie said:

This indeed is the way to go if you use NTLM to authenticate. It's caused the infamous "double hop"-issue : NTLM only sends the authentication-data 1 hop further (from client to WFE). This should be solved if you use Kerberos for authentication. That way the authentication-data will go all the way : client to WFE to ISA.

September 8, 2007 3:40 AM
 

Shai said:

How, in God's name do you pass credentials to the rss source when using the rss feed webpart ? I do not mean the windows cred of the current user but creds required to access a private rss feed.

November 11, 2007 8:37 PM

Leave a Comment

(required )  
(optional )
(required )  
Add

About mhofer1976

For all of my IT carreer, I've been addicted to Microsoft-based software development, starting with VB, but then heading straight towards the .NET Framework in its earliest days. While working in different positions as a lead developer, project manager, pre-sales consultant and most recently a business unit manager, I've always kept beeing a developer and specialized on solutions in the Information Worker area, with an emphasis towards Enterprise Content Management. The Microsoft Office System and especially the SharePoint products and technologies are my favorite "playground", one big reason why I've joined the Microsoft Consulting Services in Switzerland where I'm currently working as Senior Consultant for Information Worker solutions.

Need SharePoint Training? Attend a SharePoint Bootcamp!

Posts (c) their respective authors. Everything else (c) 2007 SharePoint Experts