Accessing TM1Web asks for Windows login

[jed]

There is something strange happening when I try to login toTM1Web.

Accessing TM1 via perspectives (with integrated login checked) works fine.
When I try to access TM1Web locally on my machine I get a windows login request and cannot access the website (even if I enter my details).
If I connect to the server via remote desktop and try to login to the web on the server I can login automatically (using intergrated login).

My TM1 account is an admin account and I am a local administrator on the server.

Has anyone seen this before?

Jed

[mattgoff]

Does your tm1web folder have permissions set to Everyone/Full Control? You may need to also refresh child object permissions by going to Security->Advanced->Replace permission entries on all child objects...

Matt

[jed]

Yes, the tm1web folder does have permissions set to Everyone/Full control and I have done a refresh of child object permissions.....
jed

[mattgoff]

Are you using NTLM or Kerberos?

Just to make sure, double-check that your web.config file has the two changes made (key IntegratedLogin and identity impersonate set to true) and IIS has anonymous access disabled and Integrated Login enabled. Also, on your PC (not the server) ensure that Control Panel --> User Accounts --> Advanced --> Manage Passwords does not have a stored user/pass for your TM1 server.

Matt

[jed]

Are you using NTLM or Kerberos?

Just to make sure, double-check that your web.config file has the two changes made (key IntegratedLogin and identity impersonate set to true) and IIS has anonymous access disabled and Integrated Login enabled. Also, on your PC (not the server) ensure that Control Panel --> User Accounts --> Advanced --> Manage Passwords does not have a stored user/pass for your TM1 server.

Thanks Matt.....

We're using NTLM. The web.config file definately has IntegratedLogin and identity impersonate set to true and IIS has anonymous access is disabled and Integrated Login enabled. There are no stored passwords on my pc for TM1.

I have checked and rechecked these settings many many times just in case I am going crazy....which I think I am now!

The strange thing is that this is working fine on 1 of our servers but not the other. I have also discovered now that it works for some users but not others.

jed

[LoadzaGrunt]

One thing to check is the individual settings within IE.

If you goto Tools->Internet Options->Security you will see a number of zones (like Intranet, Internet etc). You probably want TM1 Web to be in your Intranet zone but you'd need to talk to your network people about making that happen if it wasn't already.

Click on the Intranet zone icon, then 'Custom Level'. Right down at the bottom there are some options for 'User Authentication'. You probably want the second option 'Automatic logon only in the internet zone'. I think that will probably get rid of your pop-up for the users Windows credentials.

These settings can change so it might also explain why your issue occurs for some users, but not others.

HTH

[jed]

If you goto Tools->Internet Options->Security you will see a number of zones (like Intranet, Internet etc). You probably want TM1 Web to be in your Intranet zone but you'd need to talk to your network people about making that happen if it wasn't already.

Click on the Intranet zone icon, then 'Custom Level'. Right down at the bottom there are some options for 'User Authentication'. You probably want the second option 'Automatic logon only in the internet zone'. I think that will probably get rid of your pop-up for the users Windows credentials.

Thanks but I don't think this is the cause - TM1web is already in our intranet zone and I already have this setting in IE. I have checked this previously on both users (where it works for 1 but not the other) and the setting is always the same for all users. It also wouldn't makes sense for this to be the cause given that the problem exists for 1 TM1 Server but not the other??

cheers
jed

[mattgoff]

When a PC prompts for a password when you access TM1 Web, it fails even if you attempt to login with domain\username and password, right? What happens if you keep clicking "cancel" until it stops prompting? Do you see partial text of the login screen?

Matt

[jed]

When a PC prompts for a password when you access TM1 Web, it fails even if you attempt to login with domain\username and password, right? What happens if you keep clicking "cancel" until it stops prompting? Do you see partial text of the login screen?

If I attempt to login with a domain\username and password my network account normally ends up getting locked. If I keep clicking cancel until it stops prompting I get to a screen that appears to be the main entry screen after login to TM1web - all white screen with left hand navigation section and main section in the right - again all white. There is text in both parts of the screen that says "Error: Access is Denied."

jed

[mattgoff]

I know you said you already did this, but the symptoms you describe sound exactly like a Windows permissions issue. I lived through this myself three weeks ago as the permissions did not get set correctly when we upgraded from 9.1.4 to 9.5.

I recommend that you set permissions on inetpub (not tm1web) to Everyone/Full Control and manually force child objects to be reset to inetpub permissions (via Security->Advanced). After that, make sure to stop/restart both the web site and the application pool. For good measure, you might want to run iisreset at the command prompt.

If none of this works, I'm out of ideas.

Matt