EPortfolio - Account Information Is Not Recgonized

[mrees]

Dear Tipsters,

We are using CE9.

For our internal use we use WindowsNT Authentication with users in a specific NT Group to be given access. Until recently this works a treat. I have found that 3 (so far) users out of around 50 regular users cannot gain access, when they try they get the follwing message.

Account Information Not Recognized
An internal error has occurred in the NT Authentication plugin while
trying to establish group membership. Please make sure that each mapped NT
group belongs to an accessible domain.
Please check that the appropriate APS name and authentication type are
specified.
Re-enter your user name and password, and click Log On.
If you are unsure of your account information, contact your system
administrator.

If I then try to log on using their machine, everything is fine.

I have checked that their accounts are not locked and they are members of the correct group. (This is made even easier to check as 2 of the people concerned are ITHelpdesk staff)

I am at a loss as what to do with this, and slightly worried, as our reports are due to be rolled out to a further 600+ staff today!!

Thanks in advance

mrees

 

[rhinok]

If I then try to log on using their machine, everything is fine.

I had a similar problem with a previous client that used NT security with SSO. Turns out multiple users were using the same workstation (a wireless-enabled laptop bolted to a cart on the shop floor), but weren't logging off. When the next user tried to access CE, it wouldn't work because it wasn't authenticated to his/her NT ID, because he or she wasn't actually logged in. Completely user error.


~Kurt

 

[KingfisherINC]

Could it be that the user is in more than 100 groups:

A user is a member of more than 100 groups. When the user attempts to log on to Crystal Enterprise using Windows NT Authentication, the authentication fails.

http://support.businessobjects.com/library/kbase/articles/c2015765.asp

Kingfisher [CECP]

 

[synapsevampire]

Are you using single sign on?

Here's the whitepaper (CE 8, but it's applicable):

http://support.businessobjects.com/communityCS/TechnicalPapers/ce8_nt_authentication.pdf

I have 2 sets of eportfolio, one unadulterated, and one where I apply code to satisfy requirements.

Perhaps they are in a group which does not have authority and a group which does?

-k

 

[mrees]

Thanks for all the replies, certainly some interesting "features" there, but i'm no closer to sorting this out. Further investigation has shown that no member of our IT Helpdesk team can gain access to CE. I have checked that they are not in more than 100 groups, and we don't use single sign on. My thinking is that there could be some conflict with their membership in another group. Does anybody know of an issue here? Certainly our Helpdesk Team will be in NT Groups that give them more permissions on the network than a regular employee. I notice that the error message is different to the standard you get when your password is wrong or entering a username that does not exist. Which incidently is

Account Information Not Recognized
NT Authentication could not log you on. Please make sure your logon information is correct. If your account is in any domain other than "MyDomain" you must enter your user name as DomainName\UserName.
Please check that the appropriate APS name and authentication type are specified.
Re-enter your user name and password, and click Log On.
If you are unsure of your account information, contact your system administrator.

I have emailed BO about this, I look forward to their reply.

mrees

 

[rhinok]

So you have verified that these users are part of the Crystal NT Users group? Have you updated the group within the CMC to pull in all of the users? Do they belong to a different domain, which would necessitate the use of their domain\user id instead of just the user id?

~Kurt

 

[mrees]

I realise I may have confused matters with my last post, I was demonstrating that the message these users get (in my first post) is different to the standard message that a non-existent user would get (second post). Our Helpdesk get the first message. They are now telling me that they used to be able to access CE some time ago, but now they can't.

I must apologise if i am a little unsure of the correct terminology, as I have only just inherited (haha-little CE joke there) the admin role for CE recently. We have used the CMC and the Manage Authorization method to map NT users to CE accounts. So am I right in thinking that the Crystal NT Users Group is not needed here?

Yours, utterly confused

Martin

 

[rhinok]

In order for you to manage these members using NT Authentication, they must be a part of the Crystal NT Users Group on the CE Server (or another group that you've mapped). Double-check that these users are in the group, under the correct domain. Then update the NT Authentication Tab. Next check the User list to make sure these users are still there (if they weren't in the list, they would get dropped by the update) and that they are enabled.

~Kurt

 

[mrees]

Thanks for the reply, I have checked all the above and it seems ok, but we are still getting more users unable to access. It has now happened to a couple of report developers and seemingly the NT account that runs the reports, CDRepadmin (Is this the standard name for this account, or something the previous CE Admin set up?)

I cannot run any reports when I log into CE, I am in the Administrators group. I created an Enterprise Authenticated account, put it into the same Admin group. That account can schedule/run reports fine.

We run most of our reports from event files created by our SQL server, around 4 days ago and on two nights running, every single report failed with the same message "Object failed to run due to insufficient security privileges". In the last 2 days, all reports run in the early hours of the morning (the same that failed before) have run, any reports that have run later than 12ish, have failed with the same message. Also any reports that fail, have their recurring schedule deleted!

Crystal Technical support do not seem to know what the problem is. They seem to think it is something to do with us having Active Directory running in Native mode, and that we should have installed the AD plugin (we haven't). But they also say that CE will never have worked without it. Either this is not quite right, or we have had 600 staff having the same hallucination for the past 3 years.

Unless this has sparked some deep thought amongst you all, I am going to end this thread until we/BO come up with a solution, which I will then post if anyone is interested. Today we are going to dust off our disaster recovery box and see if we can re-create the fault...

Cheers

Martin

 

[sandy3269]

Hi,

I recently had this problem. CE9 was working correctly, then some users could not get validated. Same errors you show.

After much pain with various staff here and at BO, I ended up replacing a corrupt plugin, rebooted and we were straight again.

I am not were I can grab the articule name I got the information from, but it is on BO's site as a solution to a problem someone else had.

Good luck!

 

[mrees]

Sandy3269,

It would be of great help to me if you could remember the article this came from. Can you give me anymore detail on it?

BO are saying I need to install the ActiveDirectoy authentication plugin, and I would rather not as I would have to go through quite a long testing cycle. (Longer than reinstalling an already present plugin.

Thanks in advance

Martin

 

[beardenb]

Mrees,
I'm also in a CE9 environment with NT authentication. I'm stuck right now trying to sort out why 3 users can't log in that could just last week. They all say they changed their NT passwords in the last week and just one claims that he was able to access CE after the password change (he says "I think so"). Unfortunate for me, I can't reproduce the error with an account in my control and two of the folks are execs I can't bother much. The third is a salesrep on the road most of the time.

I contacted BO support yesterday and they suggested I try removing the groups he belongs to, then add the groups back and put back folder rights. The idea I guess is to remove any record of his account in CE, then put it back and hope all is well. I went through that painful process, but he still cannot log in.

I did notice something interesting with this one account -- I checked the user list of one of the groups he's in, call it Group1. I see him in the user list for this group, click on his user ID, then click the 'Member of' tab. It only shows Everyone. Where's Group1 I wonder? I will call BO back about this because that's definitely not right.

--Bearden

 

[bvroadrunner]

We had this problem too after we upgraded from v9 to v10. We also upgraded to AD at the same time! These steps correct it:

In the CMC, Disable the account, update, then enable the account.

Also there was a default setting that changed in V10 that we found out about on the knowledge base at the Crystal technical support on-line. It reads:

Why are the new Active Directory users not visible after updating?

The information in the article refers to:
Crystal Enterprise 10

Applies to:

Reported version only
Why can't you see new users?
Updating Active Directory users & aliases


Synopsis

After mapping a Windows NT or Active Directory
domain group and clicking 'Update', the user
accounts in Crystal Enterprise 10 are not created.

Why does this behavior occur and how do you
resolve it?

Solution

This behavior occurs because the 'Update' command
has been changed in version 10 of Crystal
Enterprise (CE). In CE 10, you can select between
two options how the update behaves:

• 'No new aliases will be added and new users will
not be created'

This is the default option. With this option, user
accounts and aliases are created during the initial
logon. This behavior is designed to lessen the
workload on the Crystal Management Server (CMS).
Retrieving large user lists can increase the
server's workload.

• 'New aliases will be added and new users will be
created'

This option updates all mapped users into Crystal
Enterprise when you click 'Update'.

If you want the 'Update' command to behave similar
to how it behaved in Crystal Enterprise 9, change
the option to 'New aliases will be added and new
users will be created'.