154: TM1 API DOTNET Exception: -failed to create client cred

[Jeroen Eynikel]

Hi all,

I wonder whether someone has some advice on this?

I have setup TM1 v 9.5.1 including TM1 web using integrated login.

Using the normal clients (architect / perspectives) everything works fine.
Using the web it all works fine as long as I am logged in to the server. (I.e. if I control the server over RD and then go to localhost/tm1web) it will log me in aso... no problems.

When trying to connect from another machine though, the normal clients work, but with TM1Web I get the message above when trying to log in.

Everything is in the same domain.

Anyone have any idea on where to start looking? The settings that are specified in the web config in order to enable integrated login have been set and so have the two IIS settings that are mentioned in there.

Thanks for any advice,

Jeroen

[dkleist]

Have you added the the webserver as a site in IE security options for the machines? Sometimes that does works for me:
IE browser, Tools, Internet Options, Security tab. Advanced, Sites.
Add the http://server to the Local Intranet sites
(sometimes credentials get stripped away when browsing to webserver)

[Jeroen Eynikel]

I managed to resolve the problem - In case anyone ever encounters it I'll detail below.

Apparently it is due to some conflicting SPN's (Service Principal Names). Unfortunately my knowledge of these kind of things is very limited and my interest in these kind of things is less than limited

On the upside however an alternative way to solve it (instead of dealing with the SPN's) was switch the security protocol in the TM1 config file to NTLM instead of Kerberos. It works fine after doing that.

[Selvin]

TM1APIDOTNET Exception: - CAM security is required to login to server:

This is the code which i am using to Login to TM1server using C#.Net.

protected int tm1Main()
{
String adminHost, tm1Svr, tm1Uid, tm1Pwd;
adminHost = "INFPWH0040";
tm1Svr = "developer";
tm1Uid = "xxx";
tm1Pwd = "xx";
int nRtn = 0;

// Start by creating an Admin Server object
TM1AdminServer admin = new TM1AdminServer(adminHost, "tm1adminserver");

try
{
//admin.Servers[tm1Svr].GetCAMLoginEnabled(tm1Svr);
// Obtain "sdata" server info object and then login
TM1Server server = admin.Servers[tm1Svr].Login(tm1Uid, tm1Pwd); //server.Processes.Count
if (server != null)
{
// Start using database server
TM1CubeCollection cubes = server.Cubes;
//Label1.Text = "Number of cubes: " + cubes.Count;

foreach (TM1Cube cube in cubes)
{
//ListBox1.Items.Add(cube.Name);
}

}
else
{
// Handle failure to login
nRtn = -1;
}
}
catch (Exception exc)
{
// Handle exception
nRtn = -2;
}

// We're done with all database servers and the Admin Server object
admin.LogoutAll();
admin.Dispose();
return nRtn;
}

previously this was running when the Integrationmode = 1 and now when the integrationmode is changed to 4. it is giving the above error..

[mike_pvs]

Have you resolved your problem?

I met the same issue yesterday but unfortunately can't find proper solution.
IntegratedSecurityMode is set to 5 and can't be changed due to security restrictions.

So when I try this code:

Code: Select all

TM1AdminServer admin = new TM1AdminServer(hostName, "tm1adminserver");
admin.Servers[serverName].Login(userName, password);

It gives me "CAM security is required to login to server" exception,
but when I change it to

Code: Select all

TM1AdminServer admin = new TM1AdminServer(hostName, "tm1adminserver");
admin.Servers[serverName].LoginUsingCAMNamespace(namespace, userName, password);

it tells "Either the login name or the password is incorrect"
although I'm using the same credentials to connect via Architect / TM1 Web.

What could be the reason?

[declanr]

Code: Select all

TM1AdminServer admin = new TM1AdminServer(hostName, "tm1adminserver");
admin.Servers[serverName].LoginUsingCAMNamespace(namespace, userName, password);

it tells "Either the login name or the password is incorrect"
although I'm using the same credentials to connect via Architect / TM1 Web.

What could be the reason?

I tend not to use CAM so I could be sending you in completely the wrong direction but I believe that the username you enter and what gets resolved are slightly differently e.g. a user of John.Smith actually comes through as something along the lines of CAMID("John.Smith")... I can't remember the exact format but will see if I can find/remember it.


Edit - Possibly remembered it to be CAMID("Server:UserName") e.g. CAMID("Prod:John.Smith")

This had to be used to connect to the CXMD service in Framework Manager for Cognos Express set up with CAM logons anyway so it's a completely different scenario but doesn't hurt to try.

[mike_pvs]

Thanks a lot for suggestion!

Here is what I have tried (unfortunately without luck, will try more later):

Code: Select all

LoginUsingCAMNamespace("Active Directory", "CAMID(\"Server_Test:USR\")", "Password");
LoginUsingCAMNamespace("Active Directory", "CAMID(Server_Test:USR)", "Password");
LoginUsingCAMNamespace("Active Directory", "CAMID(\"USR\")", "Password");
LoginUsingCAMNamespace("Active Directory", "CAMID(USR)", "Password");
LoginUsingCAMNamespace("Active Directory", "CAMID(\"AD:u:497280c0b11b2e41b9c616b70b1d738e\")", "Password");
LoginUsingCAMNamespace("Active Directory", "CAMID(AD:u:497280c0b11b2e41b9c616b70b1d738e)", "Password");

Is it what you've suggested? Do you know by any chance where I can get any documentation regarding this?

[mike_pvs]

Could anyone share *.chm with documentation for TM1 .Net API? It is not installed on the server and I can't find it online.

[mike_pvs]

Finally I was able to connect TM1. The correct code is:

Code: Select all

admin.Servers["SERVER"].LoginUsingCAMNamespace("NAMESPACE", "USER", "PASSWORD");

where USER is normal user name (like "John Smith"), PASSWORD is normal password, but NAMESPACE is the tricky one.

When I log in using Architect and Cognos login form, namespace is displayed as "Active Directory", but for successful login in my case it should be "AD".
I got this abbreviation from status bar of Clients/Group security window where current user was displayed in the next form:

Server:SERVER Client:CAMID("AD:u:497280c0b11b2e41b9c616b70b1d738e")