RE: Cannot connect to SharePoint 2010 instance
Thanks Karl I will give it a try today -Original Message- From: Karl Wright [mailto:daddy...@gmail.com] Sent: Wednesday, December 05, 2012 6:04 PM To: user@manifoldcf.apache.org Subject: Re: Cannot connect to SharePoint 2010 instance Hi Robert, I've solved Luigi's problem - and now I want to know if it solves yours. Unfortunately, you WILL have to build ManifoldCF for this step, since I cannot modify the build process easily to accommodate the patched httpcomponents dependencies. Can you do the following: (1) Check out a trunk copy of manifoldcf sources, e.g svn co https://svn.apache.org/repos/asf/manifoldcf/trunk; . (2) Download the lib package from http://people.apache.org/~kwright/apache-manifoldcf-1.1-dev, unpack it, and install it in the lib directory as per the instructions in the lib package. (3) Run ant build to be sure you can actually build the project. If that works, download the two patched httpcomponents jars from http://people.apache.org/~kwright , and use them to overwrite lib/httpcore.jar and lib/httpclient.jar. (4) Run ant build clean (5) Start manifoldcf (it's under the dist directory), and see if you can connect to your sharepoint instance. Thanks! Karl On Thu, Nov 29, 2012 at 8:56 AM, Iannetti, Robert robert.ianne...@novartis.com wrote: Hi Karl, I have been following your thread with Luigi I look forward to testing the new release. Thanks Bob -Original Message- From: Karl Wright [mailto:daddy...@gmail.com] Sent: Thursday, November 29, 2012 3:28 AM To: user@manifoldcf.apache.org Subject: Re: Cannot connect to SharePoint 2010 instance Hi Robert, Luigi and I think we've discovered the issue, which we're going to see if we can confirm today. There is a ticket tracking it, which is CONNECTORS-572. If correct, it appears that Windows may have changed what it considers to be the name of the user at some recent time, and the httpcomponents and commons-httpclient implementations of NTLM are not resilient to this change - which isn't surprising since they are basically reverse-engineered. If correct, httpcomponents will likely need to release a patch, so the schedule will be, in part, up to them. Alternatively, we can build and patch httpcomponents as part of the ManifoldCF release process, but it would require us to have a new Maven dependency for the make-core-deps part of our release. Karl On Wed, Nov 28, 2012 at 9:01 AM, Iannetti, Robert robert.ianne...@novartis.com wrote: Karl, Here is my debug output DEBUG 2012-11-28 08:59:25,884 (Thread-479) - POST /_vti_bin/lists.asmx HTTP/1 .1 DEBUG 2012-11-28 08:59:25,899 (Thread-479) - Content-Type: text/xml; charset= utf-8 DEBUG 2012-11-28 08:59:25,899 (Thread-479) - SOAPAction: http://schemas.micr osoft.com/sharepoint/soap/GetListCollection DEBUG 2012-11-28 08:59:25,899 (Thread-479) - User-Agent: Axis/1.4 DEBUG 2012-11-28 08:59:25,899 (Thread-479) - Content-Length: 335 DEBUG 2012-11-28 08:59:25,899 (Thread-479) - Host: searchpoc.testprojects.nib r.novartis.intra DEBUG 2012-11-28 08:59:25,899 (Thread-479) - Connection: Keep-Alive DEBUG 2012-11-28 08:59:30,629 (Thread-479) - HTTP/1.1 401 Unauthorized DEBUG 2012-11-28 08:59:30,629 (Thread-479) - Server: Microsoft-IIS/7.5 DEBUG 2012-11-28 08:59:30,629 (Thread-479) - SPRequestGuid: 56647ed0-9bac-4a2 e-b61a-2d2e76ae8db0 DEBUG 2012-11-28 08:59:30,629 (Thread-479) - WWW-Authenticate: NTLM DEBUG 2012-11-28 08:59:30,629 (Thread-479) - X-Powered-By: ASP.NET DEBUG 2012-11-28 08:59:30,630 (Thread-479) - MicrosoftSharePointTeamServices: 14.0.0.6123 DEBUG 2012-11-28 08:59:30,630 (Thread-479) - X-MS-InvokeApp: 1; RequireReadOn ly DEBUG 2012-11-28 08:59:30,630 (Thread-479) - Date: Wed, 28 Nov 2012 13:59:30 GMT DEBUG 2012-11-28 08:59:30,630 (Thread-479) - Content-Length: 0 DEBUG 2012-11-28 08:59:30,663 (Thread-479) - POST /_vti_bin/lists.asmx HTTP/1.1 DEBUG 2012-11-28 08:59:30,663 (Thread-479) - Content-Type: text/xml; charset=utf-8 DEBUG 2012-11-28 08:59:30,663 (Thread-479) - SOAPAction: http://schemas.microsoft.com/sharepoint/soap/GetListCollection; DEBUG 2012-11-28 08:59:30,663 (Thread-479) - User-Agent: Axis/1.4 DEBUG 2012-11-28 08:59:30,663 (Thread-479) - Content-Length: 335 DEBUG 2012-11-28 08:59:30,663 (Thread-479) - Host: searchpoc.testprojects.nibr.novartis.intra DEBUG 2012-11-28 08:59:30,663 (Thread-479) - Connection: Keep-Alive DEBUG 2012-11-28 08:59:30,663 (Thread-479) - Authorization: NTLM TlRMTVNTUAABNQIIIAoACgBAIAAgACBJAFAALQAxADAALQAxADQANQAtAD MAMgAtADEAMgAxAE4AQQBOAEUAVAA= DEBUG 2012-11-28 08:59:30,680 (Thread-479) - HTTP/1.1 401 Unauthorized DEBUG 2012-11-28 08:59:30,680 (Thread-479) - Server: Microsoft-IIS/7.5 DEBUG 2012-11-28 08:59:30,680 (Thread-479) - SPRequestGuid: 208f5c66-7d26-4761-b578-d01645f042ed DEBUG 2012-11-28 08:59:30,680 (Thread-479) - WWW-Authenticate: NTLM TlRMTVNTUAACDgAOADg1Aoki47BOSwwS
Re: Cannot connect to SharePoint 2010 instance
Hi Robert, I've solved Luigi's problem - and now I want to know if it solves yours. Unfortunately, you WILL have to build ManifoldCF for this step, since I cannot modify the build process easily to accommodate the patched httpcomponents dependencies. Can you do the following: (1) Check out a trunk copy of manifoldcf sources, e.g svn co https://svn.apache.org/repos/asf/manifoldcf/trunk; . (2) Download the lib package from http://people.apache.org/~kwright/apache-manifoldcf-1.1-dev, unpack it, and install it in the lib directory as per the instructions in the lib package. (3) Run ant build to be sure you can actually build the project. If that works, download the two patched httpcomponents jars from http://people.apache.org/~kwright , and use them to overwrite lib/httpcore.jar and lib/httpclient.jar. (4) Run ant build clean (5) Start manifoldcf (it's under the dist directory), and see if you can connect to your sharepoint instance. Thanks! Karl On Thu, Nov 29, 2012 at 8:56 AM, Iannetti, Robert robert.ianne...@novartis.com wrote: Hi Karl, I have been following your thread with Luigi I look forward to testing the new release. Thanks Bob -Original Message- From: Karl Wright [mailto:daddy...@gmail.com] Sent: Thursday, November 29, 2012 3:28 AM To: user@manifoldcf.apache.org Subject: Re: Cannot connect to SharePoint 2010 instance Hi Robert, Luigi and I think we've discovered the issue, which we're going to see if we can confirm today. There is a ticket tracking it, which is CONNECTORS-572. If correct, it appears that Windows may have changed what it considers to be the name of the user at some recent time, and the httpcomponents and commons-httpclient implementations of NTLM are not resilient to this change - which isn't surprising since they are basically reverse-engineered. If correct, httpcomponents will likely need to release a patch, so the schedule will be, in part, up to them. Alternatively, we can build and patch httpcomponents as part of the ManifoldCF release process, but it would require us to have a new Maven dependency for the make-core-deps part of our release. Karl On Wed, Nov 28, 2012 at 9:01 AM, Iannetti, Robert robert.ianne...@novartis.com wrote: Karl, Here is my debug output DEBUG 2012-11-28 08:59:25,884 (Thread-479) - POST /_vti_bin/lists.asmx HTTP/1 .1 DEBUG 2012-11-28 08:59:25,899 (Thread-479) - Content-Type: text/xml; charset= utf-8 DEBUG 2012-11-28 08:59:25,899 (Thread-479) - SOAPAction: http://schemas.micr osoft.com/sharepoint/soap/GetListCollection DEBUG 2012-11-28 08:59:25,899 (Thread-479) - User-Agent: Axis/1.4 DEBUG 2012-11-28 08:59:25,899 (Thread-479) - Content-Length: 335 DEBUG 2012-11-28 08:59:25,899 (Thread-479) - Host: searchpoc.testprojects.nib r.novartis.intra DEBUG 2012-11-28 08:59:25,899 (Thread-479) - Connection: Keep-Alive DEBUG 2012-11-28 08:59:30,629 (Thread-479) - HTTP/1.1 401 Unauthorized DEBUG 2012-11-28 08:59:30,629 (Thread-479) - Server: Microsoft-IIS/7.5 DEBUG 2012-11-28 08:59:30,629 (Thread-479) - SPRequestGuid: 56647ed0-9bac-4a2 e-b61a-2d2e76ae8db0 DEBUG 2012-11-28 08:59:30,629 (Thread-479) - WWW-Authenticate: NTLM DEBUG 2012-11-28 08:59:30,629 (Thread-479) - X-Powered-By: ASP.NET DEBUG 2012-11-28 08:59:30,630 (Thread-479) - MicrosoftSharePointTeamServices: 14.0.0.6123 DEBUG 2012-11-28 08:59:30,630 (Thread-479) - X-MS-InvokeApp: 1; RequireReadOn ly DEBUG 2012-11-28 08:59:30,630 (Thread-479) - Date: Wed, 28 Nov 2012 13:59:30 GMT DEBUG 2012-11-28 08:59:30,630 (Thread-479) - Content-Length: 0 DEBUG 2012-11-28 08:59:30,663 (Thread-479) - POST /_vti_bin/lists.asmx HTTP/1.1 DEBUG 2012-11-28 08:59:30,663 (Thread-479) - Content-Type: text/xml; charset=utf-8 DEBUG 2012-11-28 08:59:30,663 (Thread-479) - SOAPAction: http://schemas.microsoft.com/sharepoint/soap/GetListCollection; DEBUG 2012-11-28 08:59:30,663 (Thread-479) - User-Agent: Axis/1.4 DEBUG 2012-11-28 08:59:30,663 (Thread-479) - Content-Length: 335 DEBUG 2012-11-28 08:59:30,663 (Thread-479) - Host: searchpoc.testprojects.nibr.novartis.intra DEBUG 2012-11-28 08:59:30,663 (Thread-479) - Connection: Keep-Alive DEBUG 2012-11-28 08:59:30,663 (Thread-479) - Authorization: NTLM TlRMTVNTUAABNQIIIAoACgBAIAAgACBJAFAALQAxADAALQAxADQANQAtAD MAMgAtADEAMgAxAE4AQQBOAEUAVAA= DEBUG 2012-11-28 08:59:30,680 (Thread-479) - HTTP/1.1 401 Unauthorized DEBUG 2012-11-28 08:59:30,680 (Thread-479) - Server: Microsoft-IIS/7.5 DEBUG 2012-11-28 08:59:30,680 (Thread-479) - SPRequestGuid: 208f5c66-7d26-4761-b578-d01645f042ed DEBUG 2012-11-28 08:59:30,680 (Thread-479) - WWW-Authenticate: NTLM TlRMTVNTUAACDgAOADg1Aoki47BOSwwS+moAAMoAygBGBgGxHQ 9OAEkAQgBSAE4ARQBUAAIADgBOAEkAQgBSAE4ARQBUAAEAGABOAFIAVQBTAEMA QQAtAFMARAAwADcAOQAEACIAbgBpAGIAcgAuAG4AbwB2AGEAcgB0AGkAcwAuAG4AZQB0AA MAPABOAFIAVQBTAEMAQQAtAFMARAAwADcAOQAuAG4AaQBiAHIALgBuAG8AdgBhAHIAdABp
Re: Cannot connect to SharePoint 2010 instance
I actually did decide to modify the build to pull the changed jars down automatically. So you can just download the artifacts under http://people.apache.org/~kwright/apache-manifoldcf-1.1-dev and you should get updated binaries. Karl On Wed, Dec 5, 2012 at 6:03 PM, Karl Wright daddy...@gmail.com wrote: Hi Robert, I've solved Luigi's problem - and now I want to know if it solves yours. Unfortunately, you WILL have to build ManifoldCF for this step, since I cannot modify the build process easily to accommodate the patched httpcomponents dependencies. Can you do the following: (1) Check out a trunk copy of manifoldcf sources, e.g svn co https://svn.apache.org/repos/asf/manifoldcf/trunk; . (2) Download the lib package from http://people.apache.org/~kwright/apache-manifoldcf-1.1-dev, unpack it, and install it in the lib directory as per the instructions in the lib package. (3) Run ant build to be sure you can actually build the project. If that works, download the two patched httpcomponents jars from http://people.apache.org/~kwright , and use them to overwrite lib/httpcore.jar and lib/httpclient.jar. (4) Run ant build clean (5) Start manifoldcf (it's under the dist directory), and see if you can connect to your sharepoint instance. Thanks! Karl On Thu, Nov 29, 2012 at 8:56 AM, Iannetti, Robert robert.ianne...@novartis.com wrote: Hi Karl, I have been following your thread with Luigi I look forward to testing the new release. Thanks Bob -Original Message- From: Karl Wright [mailto:daddy...@gmail.com] Sent: Thursday, November 29, 2012 3:28 AM To: user@manifoldcf.apache.org Subject: Re: Cannot connect to SharePoint 2010 instance Hi Robert, Luigi and I think we've discovered the issue, which we're going to see if we can confirm today. There is a ticket tracking it, which is CONNECTORS-572. If correct, it appears that Windows may have changed what it considers to be the name of the user at some recent time, and the httpcomponents and commons-httpclient implementations of NTLM are not resilient to this change - which isn't surprising since they are basically reverse-engineered. If correct, httpcomponents will likely need to release a patch, so the schedule will be, in part, up to them. Alternatively, we can build and patch httpcomponents as part of the ManifoldCF release process, but it would require us to have a new Maven dependency for the make-core-deps part of our release. Karl On Wed, Nov 28, 2012 at 9:01 AM, Iannetti, Robert robert.ianne...@novartis.com wrote: Karl, Here is my debug output DEBUG 2012-11-28 08:59:25,884 (Thread-479) - POST /_vti_bin/lists.asmx HTTP/1 .1 DEBUG 2012-11-28 08:59:25,899 (Thread-479) - Content-Type: text/xml; charset= utf-8 DEBUG 2012-11-28 08:59:25,899 (Thread-479) - SOAPAction: http://schemas.micr osoft.com/sharepoint/soap/GetListCollection DEBUG 2012-11-28 08:59:25,899 (Thread-479) - User-Agent: Axis/1.4 DEBUG 2012-11-28 08:59:25,899 (Thread-479) - Content-Length: 335 DEBUG 2012-11-28 08:59:25,899 (Thread-479) - Host: searchpoc.testprojects.nib r.novartis.intra DEBUG 2012-11-28 08:59:25,899 (Thread-479) - Connection: Keep-Alive DEBUG 2012-11-28 08:59:30,629 (Thread-479) - HTTP/1.1 401 Unauthorized DEBUG 2012-11-28 08:59:30,629 (Thread-479) - Server: Microsoft-IIS/7.5 DEBUG 2012-11-28 08:59:30,629 (Thread-479) - SPRequestGuid: 56647ed0-9bac-4a2 e-b61a-2d2e76ae8db0 DEBUG 2012-11-28 08:59:30,629 (Thread-479) - WWW-Authenticate: NTLM DEBUG 2012-11-28 08:59:30,629 (Thread-479) - X-Powered-By: ASP.NET DEBUG 2012-11-28 08:59:30,630 (Thread-479) - MicrosoftSharePointTeamServices: 14.0.0.6123 DEBUG 2012-11-28 08:59:30,630 (Thread-479) - X-MS-InvokeApp: 1; RequireReadOn ly DEBUG 2012-11-28 08:59:30,630 (Thread-479) - Date: Wed, 28 Nov 2012 13:59:30 GMT DEBUG 2012-11-28 08:59:30,630 (Thread-479) - Content-Length: 0 DEBUG 2012-11-28 08:59:30,663 (Thread-479) - POST /_vti_bin/lists.asmx HTTP/1.1 DEBUG 2012-11-28 08:59:30,663 (Thread-479) - Content-Type: text/xml; charset=utf-8 DEBUG 2012-11-28 08:59:30,663 (Thread-479) - SOAPAction: http://schemas.microsoft.com/sharepoint/soap/GetListCollection; DEBUG 2012-11-28 08:59:30,663 (Thread-479) - User-Agent: Axis/1.4 DEBUG 2012-11-28 08:59:30,663 (Thread-479) - Content-Length: 335 DEBUG 2012-11-28 08:59:30,663 (Thread-479) - Host: searchpoc.testprojects.nibr.novartis.intra DEBUG 2012-11-28 08:59:30,663 (Thread-479) - Connection: Keep-Alive DEBUG 2012-11-28 08:59:30,663 (Thread-479) - Authorization: NTLM TlRMTVNTUAABNQIIIAoACgBAIAAgACBJAFAALQAxADAALQAxADQANQAtAD MAMgAtADEAMgAxAE4AQQBOAEUAVAA= DEBUG 2012-11-28 08:59:30,680 (Thread-479) - HTTP/1.1 401 Unauthorized DEBUG 2012-11-28 08:59:30,680 (Thread-479) - Server: Microsoft-IIS/7.5 DEBUG 2012-11-28 08:59:30,680 (Thread-479) - SPRequestGuid: 208f5c66-7d26-4761-b578-d01645f042ed DEBUG 2012-11-28 08:59:30,680 (Thread-479
Re: Cannot connect to SharePoint 2010 instance
BAQAAAOCqZ5Zwzc0BgVBsO4H03jQAAgAOAE4ASQBCAFIATgBFAFQAAQAYAE4AUgBVAFMAQwBBAC0AUwBEADAANwA5AAQAIgBuAGkAYgByAC4AbgBvAHYAYQByAHQAaQBzAC4AbgBlAHQAAwA8AE4AUgBVAFMAQwBBAC0AUwBEADAANwA5AC4AbgBpAGIAcgAuAG4Abw
B2AGEAcgB0AGkAcwAuAG4AZQB0AAUAIgBuAGkAYgByAC4AbgBvAHYAYQByAHQAaQBzAC4AbgBlAHQABwAIAOdjFpZwzc0BAE4AQQBOAEUAVABpAGEAbgBuAGUAcgBvADEASQBQAC0AMQAwAC0AMQA0ADUALQAzADIALQAxADIAMQA=
DEBUG 2012-11-28 08:59:31,678 (Thread-479) - HTTP/1.1 401 Unauthorized
DEBUG 2012-11-28 08:59:31,678 (Thread-479) - Server: Microsoft-IIS/7.5
DEBUG 2012-11-28 08:59:31,678 (Thread-479) - SPRequestGuid:
cfac18c9-3870-4854-bb2d-816f3dc8c2f3
DEBUG 2012-11-28 08:59:31,678 (Thread-479) - WWW-Authenticate: NTLM
DEBUG 2012-11-28 08:59:31,678 (Thread-479) - X-Powered-By: ASP.NET
DEBUG 2012-11-28 08:59:31,678 (Thread-479) -
MicrosoftSharePointTeamServices: 14.0.0.6123
DEBUG 2012-11-28 08:59:31,678 (Thread-479) - X-MS-InvokeApp: 1;
RequireReadOnly
DEBUG 2012-11-28 08:59:31,678 (Thread-479) - Date: Wed, 28 Nov 2012
13:59:31 GMT
DEBUG 2012-11-28 08:59:31,678 (Thread-479) - Content-Length: 0
-Original Message-
From: Karl Wright [mailto:daddy...@gmail.com]
Sent: Tuesday, November 27, 2012 5:25 PM
To: user@manifoldcf.apache.org
Subject: Re: Cannot connect to SharePoint 2010 instance
no, you need:
log4j.logger.logger_name=DEBUG
in this case:
log4j.logger.org.apache.http.headers=DEBUG
Thanks,
Karl
On Tue, Nov 27, 2012 at 3:30 PM, Iannetti, Robert
robert.ianne...@novartis.com wrote:
Karl,
I added the parameter to the logging.ini file and I am still not
seeing any data written to the log
# Licensed to the Apache Software Foundation (ASF) under one or more #
contributor license agreements. See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to You under the Apache License, Version
2.0 # (the License); you may not use this file except in compliance
with # the License. You may obtain a copy of the License at #
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an AS IS BASIS, #
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
log4j.appender.MAIN.File=logs/manifoldcf.log
log4j.rootLogger=WARN, MAIN
log4j.appender.MAIN=org.apache.log4j.RollingFileAppender
log4j.appender.MAIN.layout=org.apache.log4j.PatternLayout
log4j.appender.MAIN.layout.ConversionPattern=%5p %d{ISO8601} (%t) -
%m%n
# add additional logging
org.apache.http.headers=DEBUG
-Original Message-
From: Karl Wright [mailto:daddy...@gmail.com]
Sent: Tuesday, November 27, 2012 3:20 PM
To: user@manifoldcf.apache.org
Subject: Re: Cannot connect to SharePoint 2010 instance
Yes.
Karl
On Tue, Nov 27, 2012 at 2:14 PM, Iannetti, Robert
robert.ianne...@novartis.com wrote:
So would the org.apache.http.headers=DEBUG replace the
log4j.logger.httpclient.wire=DEBUG entry in the logging.ini file?
-Original Message-
From: Karl Wright [mailto:daddy...@gmail.com]
Sent: Tuesday, November 27, 2012 2:07 PM
To: user@manifoldcf.apache.org
Subject: Re: Cannot connect to SharePoint 2010 instance
Here we go:
Header logging: org.apache.http.headers=DEBUG Wire logging (which we
probably don't need): org.apache.http.wire=DEBUG
Karl
On Tue, Nov 27, 2012 at 2:04 PM, Karl Wright daddy...@gmail.com wrote:
The wire debugging setup you are using will only work with
commons-httpclient, not the new httpcomponent package. I'll have to
do some research and see if there's a comparable logger setting for
that package.
Karl
On Tue, Nov 27, 2012 at 2:01 PM, Iannetti, Robert
robert.ianne...@novartis.com wrote:
Karl,
It's odd I added this to the properties.xml file property
name=org.apache.manifoldcf.connectors value=DEBUG/
And this to the logging.ini file
log4j.logger.httpclient.wire=DEBUG
I restarted manifold but nothing is being written to the
manifoldcf.log file
Any thoughts?
Here is the curl data
[iannero1@ip-10-145-32-121 logs]$ curl --data POST --ntlm -u
nanet\\iannero1
http://searchpoc.testprojects.nibr.novartis.intra/_vti_bin/MCPermissions.asmx
-v Enter host password for user 'nanet\iannero1':
* About to connect() to searchpoc.testprojects.nibr.novartis.intra port
80 (#0)
* Trying 160.62.169.185... connected
* Connected to searchpoc.testprojects.nibr.novartis.intra
(160.62.169.185) port 80 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
* Server auth using NTLM with user 'nanet\iannero1'
POST /_vti_bin/MCPermissions.asmx HTTP/1.1
Authorization: NTLM TlRMTVNTUAABBoIIAAA=
User-Agent: curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7
NSS/3.13.1.0 zlib/1.2.3 libidn/1.18 libssh2/1.2.2
Host: searchpoc.testprojects.nibr.novartis.intra
Accept: */*
Content-Length: 0
Content-Type: application/x-www-form
RE: Cannot connect to SharePoint 2010 instance
(Thread-479) - Content-Length: 0
-Original Message-
From: Karl Wright [mailto:daddy...@gmail.com]
Sent: Tuesday, November 27, 2012 5:25 PM
To: user@manifoldcf.apache.org
Subject: Re: Cannot connect to SharePoint 2010 instance
no, you need:
log4j.logger.logger_name=DEBUG
in this case:
log4j.logger.org.apache.http.headers=DEBUG
Thanks,
Karl
On Tue, Nov 27, 2012 at 3:30 PM, Iannetti, Robert
robert.ianne...@novartis.com wrote:
Karl,
I added the parameter to the logging.ini file and I am still not
seeing any data written to the log
# Licensed to the Apache Software Foundation (ASF) under one or more #
contributor license agreements. See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to You under the Apache License, Version
2.0 # (the License); you may not use this file except in compliance
with # the License. You may obtain a copy of the License at #
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an AS IS BASIS, #
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
log4j.appender.MAIN.File=logs/manifoldcf.log
log4j.rootLogger=WARN, MAIN
log4j.appender.MAIN=org.apache.log4j.RollingFileAppender
log4j.appender.MAIN.layout=org.apache.log4j.PatternLayout
log4j.appender.MAIN.layout.ConversionPattern=%5p %d{ISO8601} (%t) -
%m%n
# add additional logging
org.apache.http.headers=DEBUG
-Original Message-
From: Karl Wright [mailto:daddy...@gmail.com]
Sent: Tuesday, November 27, 2012 3:20 PM
To: user@manifoldcf.apache.org
Subject: Re: Cannot connect to SharePoint 2010 instance
Yes.
Karl
On Tue, Nov 27, 2012 at 2:14 PM, Iannetti, Robert
robert.ianne...@novartis.com wrote:
So would the org.apache.http.headers=DEBUG replace the
log4j.logger.httpclient.wire=DEBUG entry in the logging.ini file?
-Original Message-
From: Karl Wright [mailto:daddy...@gmail.com]
Sent: Tuesday, November 27, 2012 2:07 PM
To: user@manifoldcf.apache.org
Subject: Re: Cannot connect to SharePoint 2010 instance
Here we go:
Header logging: org.apache.http.headers=DEBUG Wire logging (which we
probably don't need): org.apache.http.wire=DEBUG
Karl
On Tue, Nov 27, 2012 at 2:04 PM, Karl Wright daddy...@gmail.com wrote:
The wire debugging setup you are using will only work with
commons-httpclient, not the new httpcomponent package. I'll have to
do some research and see if there's a comparable logger setting for
that package.
Karl
On Tue, Nov 27, 2012 at 2:01 PM, Iannetti, Robert
robert.ianne...@novartis.com wrote:
Karl,
It's odd I added this to the properties.xml file property
name=org.apache.manifoldcf.connectors value=DEBUG/
And this to the logging.ini file
log4j.logger.httpclient.wire=DEBUG
I restarted manifold but nothing is being written to the
manifoldcf.log file
Any thoughts?
Here is the curl data
[iannero1@ip-10-145-32-121 logs]$ curl --data POST --ntlm -u
nanet\\iannero1
http://searchpoc.testprojects.nibr.novartis.intra/_vti_bin/MCPermissions.asmx
-v Enter host password for user 'nanet\iannero1':
* About to connect() to searchpoc.testprojects.nibr.novartis.intra port 80
(#0)
* Trying 160.62.169.185... connected
* Connected to searchpoc.testprojects.nibr.novartis.intra
(160.62.169.185) port 80 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
* Server auth using NTLM with user 'nanet\iannero1'
POST /_vti_bin/MCPermissions.asmx HTTP/1.1
Authorization: NTLM TlRMTVNTUAABBoIIAAA=
User-Agent: curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7
NSS/3.13.1.0 zlib/1.2.3 libidn/1.18 libssh2/1.2.2
Host: searchpoc.testprojects.nibr.novartis.intra
Accept: */*
Content-Length: 0
Content-Type: application/x-www-form-urlencoded
HTTP/1.1 401 Unauthorized
Server: Microsoft-IIS/7.5
SPRequestGuid: f7b8f5a5-1de4-43d1-9b70-7adf3b7d5987
WWW-Authenticate: NTLM
TlRMTVNTUAACBwAHADgGgokClVhQpcbj++YAAMoAygA/BgG
TlRMTVNTUAACBwAHADgGgokClVhQpcbj++x
TlRMTVNTUAACBwAHADgGgokClVhQpcbj++H
Q9OSUJSTkVUAgAOAE4ASQBCAFIATgBFAFQAAQAYAE4AUgBVAFMAQwBBAC0AUwBE
A
D
AANwA5AAQAIgBuAGkAYgByAC4AbgBvAHYAYQByAHQAaQBzAC4AbgBlAHQAAwA8AE4AU
g
B
VAFMAQwBBAC0AUwBEADAANwA5AC4AbgBpAGIAcgAuAG4AbwB2AGEAcgB0AGkAcwAuAG
4
A
ZQB0AAUAIgBuAGkAYgByAC4AbgBvAHYAYQByAHQAaQBzAC4AbgBlAHQABwAIAA9MVPb
L
z
M0BAA==
X-Powered-By: ASP.NET
MicrosoftSharePointTeamServices: 14.0.0.6123 X-MS-InvokeApp: 1;
RequireReadOnly Date: Tue, 27 Nov 2012 18:21:04 GMT
Content-Length: 0
* Connection #0 to host searchpoc.testprojects.nibr.novartis.intra
left intact
* Issue another request to this URL:
'http
RE: Cannot connect to SharePoint 2010 instance
Thanks Karl I will try this today -Original Message- From: Karl Wright [mailto:daddy...@gmail.com] Sent: Monday, November 26, 2012 6:38 PM To: user@manifoldcf.apache.org Subject: Re: Cannot connect to SharePoint 2010 instance Ok, you can download a dev build at: http://people.apache.org/~kwright/apache-manifoldcf-1.1-dev It takes me about an hour to put one of these together, so if you can possibly build ManifoldCF yourself that would be a huge help. Karl On Mon, Nov 26, 2012 at 11:12 AM, Iannetti, Robert robert.ianne...@novartis.com wrote: That would be great please let me know when it is available Thanks Bob -Original Message- From: Karl Wright [mailto:daddy...@gmail.com] Sent: Monday, November 26, 2012 10:59 AM To: user@manifoldcf.apache.org Subject: Re: Cannot connect to SharePoint 2010 instance Hi Robert, I can build a binary version you can download, but not until tonight. It may be easier to talk through getting a build environment set up on your Linux machine. Is this Debian or Ubuntu linux, by any chance? If so, the setup is trivial and I can help you with that. Karl On Mon, Nov 26, 2012 at 10:12 AM, Iannetti, Robert robert.ianne...@novartis.com wrote: Karl, Is there a binary release (pre -compiled version) of the manifold trunk mentioned below https://svn.apache.org/repos/asf/manifoldcf/trunk that you can point me to I am new to Linux and don't have any experience with ANT. Thanks Bob -Original Message- From: Karl Wright [mailto:daddy...@gmail.com] Sent: Monday, November 26, 2012 4:32 AM To: user@manifoldcf.apache.org Subject: Re: Cannot connect to SharePoint 2010 instance I've done further research on HttpComponents' support for Kerberos. It turns out that HttpComponents claims they can successfully use tickets from the local machine's ticket store. I haven't tried this here (don't have the setup for it), but it looks like it could conceivably work with MCF trunk at this point. Read up on it here: http://hc.apache.org/httpcomponents-client-ga/tutorial/html/authentic a tion.html Ideally, of course, we'd really want to add the ability for ManifoldCF to handle its own ticket cache, one per connection, so that each connection looks like its own independent client. In order for that to happen, connectors that support Kerberos would need to be able to kerberos authenticate. But, for right now, this may work for people needing Kerberos. Karl On Sun, Nov 11, 2012 at 8:42 AM, Karl Wright daddy...@gmail.com wrote: The port of the SharePoint connector to httpcomponents 4.2.2 is complete. I don't know whether it will help you or not, but if you check out ManifoldCF trunk (from https://svn.apache.org/repos/asf/manifoldcf/trunk) and run: ant make-core-deps build ... you will be running the latest code. It has been tried against a plain-vanilla SharePoint system using standard NTLM and found to work. If you try the new code and it works for you, that would be very interesting to know; it looks like httpcomponents has developed some support for SPNEGO, which may be what is missing in the current ManifoldCF release. Thanks, Karl On Wed, Nov 7, 2012 at 4:47 PM, Karl Wright daddy...@gmail.com wrote: MCPermissions.asmx and Lists.asmx are two different services, and the Lists.asmx is likely failing before the MCPermissions.asmx is even needed. If, for instance, you are just trying with the UI to see if you get back Connection working, this makes sense since the Lists service is called first and then the MCPermissions service is called after. FWIW, I'm starting to look into porting ManifoldCF to the httpcomponent libraries from the older httpclient 3.1 world. This will make it easier, I think, to incorporate newer additions. Thanks, Karl On Wed, Nov 7, 2012 at 3:44 PM, Iannetti, Robert robert.ianne...@novartis.com wrote: Karl, It looks like I am failing connecting to the /_vti_bin/lists.asmx service but I never see the MCPermissions.asmx in any of my trace logs. Why is that? Thanks Bob -Original Message- From: Iannetti, Robert Sent: Wednesday, November 07, 2012 10:37 AM To: user@manifoldcf.apache.org Subject: RE: Cannot connect to SharePoint 2010 instance Karl, The X's you see are me trying to make the log look generic there were valid guids present in the real log. I will try WireShark and let you know the results. Thanks Bob -Original Message- From: Karl Wright [mailto:daddy...@gmail.com] Sent: Wednesday, November 07, 2012 10:32 AM To: user@manifoldcf.apache.org Subject: Re: Cannot connect to SharePoint 2010 instance This in general looks like a proper NTLM authorization sequence, except for the lack of confirmation at the end. The only thing I see that I don't recognize is this: DEBUG 2012-11-07 09:56:11,212 (Thread-441) - SPRequestGuid: xxx[\r][\n] If SharePoint is expecting
Re: Cannot connect to SharePoint 2010 instance
Hi Bob, This is really beginning to sound like there is a header problem of some kind. This is what I'd like to try. (1) Turn on wire debugging for SharePoint, as described here: https://cwiki.apache.org/confluence/display/CONNECTORS/Debugging+Connections (2) Using curl, try to use post and the proper credentials, using the -vvv switch. If you successfully connect, save that output. Then try to EXACTLY mimic the request that ManifoldCF does, and if that FAILS record that output and send it all to me. Thanks! Karl On Tue, Nov 27, 2012 at 11:22 AM, Iannetti, Robert robert.ianne...@novartis.com wrote: Hi Karl, I have installed the dev version of the connector from below and am having an issue connecting to my SharePoint 2010 site. It actually seems similar to what is happening in your thread with Luigi. I try to log in to the sharepoint site as a user with full control and I get this error Crawl user did not authenticate properly, or has insufficient permissions to access http://...: (401)HTTP/1.1 401 Unauthorized Thanks Bob -Original Message- From: Karl Wright [mailto:daddy...@gmail.com] Sent: Monday, November 26, 2012 6:38 PM To: user@manifoldcf.apache.org Subject: Re: Cannot connect to SharePoint 2010 instance Ok, you can download a dev build at: http://people.apache.org/~kwright/apache-manifoldcf-1.1-dev It takes me about an hour to put one of these together, so if you can possibly build ManifoldCF yourself that would be a huge help. Karl On Mon, Nov 26, 2012 at 11:12 AM, Iannetti, Robert robert.ianne...@novartis.com wrote: That would be great please let me know when it is available Thanks Bob -Original Message- From: Karl Wright [mailto:daddy...@gmail.com] Sent: Monday, November 26, 2012 10:59 AM To: user@manifoldcf.apache.org Subject: Re: Cannot connect to SharePoint 2010 instance Hi Robert, I can build a binary version you can download, but not until tonight. It may be easier to talk through getting a build environment set up on your Linux machine. Is this Debian or Ubuntu linux, by any chance? If so, the setup is trivial and I can help you with that. Karl On Mon, Nov 26, 2012 at 10:12 AM, Iannetti, Robert robert.ianne...@novartis.com wrote: Karl, Is there a binary release (pre -compiled version) of the manifold trunk mentioned below https://svn.apache.org/repos/asf/manifoldcf/trunk that you can point me to I am new to Linux and don't have any experience with ANT. Thanks Bob -Original Message- From: Karl Wright [mailto:daddy...@gmail.com] Sent: Monday, November 26, 2012 4:32 AM To: user@manifoldcf.apache.org Subject: Re: Cannot connect to SharePoint 2010 instance I've done further research on HttpComponents' support for Kerberos. It turns out that HttpComponents claims they can successfully use tickets from the local machine's ticket store. I haven't tried this here (don't have the setup for it), but it looks like it could conceivably work with MCF trunk at this point. Read up on it here: http://hc.apache.org/httpcomponents-client-ga/tutorial/html/authentic a tion.html Ideally, of course, we'd really want to add the ability for ManifoldCF to handle its own ticket cache, one per connection, so that each connection looks like its own independent client. In order for that to happen, connectors that support Kerberos would need to be able to kerberos authenticate. But, for right now, this may work for people needing Kerberos. Karl On Sun, Nov 11, 2012 at 8:42 AM, Karl Wright daddy...@gmail.com wrote: The port of the SharePoint connector to httpcomponents 4.2.2 is complete. I don't know whether it will help you or not, but if you check out ManifoldCF trunk (from https://svn.apache.org/repos/asf/manifoldcf/trunk) and run: ant make-core-deps build ... you will be running the latest code. It has been tried against a plain-vanilla SharePoint system using standard NTLM and found to work. If you try the new code and it works for you, that would be very interesting to know; it looks like httpcomponents has developed some support for SPNEGO, which may be what is missing in the current ManifoldCF release. Thanks, Karl On Wed, Nov 7, 2012 at 4:47 PM, Karl Wright daddy...@gmail.com wrote: MCPermissions.asmx and Lists.asmx are two different services, and the Lists.asmx is likely failing before the MCPermissions.asmx is even needed. If, for instance, you are just trying with the UI to see if you get back Connection working, this makes sense since the Lists service is called first and then the MCPermissions service is called after. FWIW, I'm starting to look into porting ManifoldCF to the httpcomponent libraries from the older httpclient 3.1 world. This will make it easier, I think, to incorporate newer additions. Thanks, Karl On Wed, Nov 7, 2012 at 3:44 PM, Iannetti, Robert robert.ianne...@novartis.com wrote: Karl
Re: Cannot connect to SharePoint 2010 instance
Hi Bob, If the headers all check out, then maybe this is the cause: http://technet.microsoft.com/en-us/library/dd566199%28v=ws.10%29.aspx I will have to check the httpcomponents code to verify that it uses at least 128-bit encryption. I won't be able to do that until tonight or tomorrow though. Karl On Tue, Nov 27, 2012 at 11:36 AM, Karl Wright daddy...@gmail.com wrote: Hi Bob, This is really beginning to sound like there is a header problem of some kind. This is what I'd like to try. (1) Turn on wire debugging for SharePoint, as described here: https://cwiki.apache.org/confluence/display/CONNECTORS/Debugging+Connections (2) Using curl, try to use post and the proper credentials, using the -vvv switch. If you successfully connect, save that output. Then try to EXACTLY mimic the request that ManifoldCF does, and if that FAILS record that output and send it all to me. Thanks! Karl On Tue, Nov 27, 2012 at 11:22 AM, Iannetti, Robert robert.ianne...@novartis.com wrote: Hi Karl, I have installed the dev version of the connector from below and am having an issue connecting to my SharePoint 2010 site. It actually seems similar to what is happening in your thread with Luigi. I try to log in to the sharepoint site as a user with full control and I get this error Crawl user did not authenticate properly, or has insufficient permissions to access http://...: (401)HTTP/1.1 401 Unauthorized Thanks Bob -Original Message- From: Karl Wright [mailto:daddy...@gmail.com] Sent: Monday, November 26, 2012 6:38 PM To: user@manifoldcf.apache.org Subject: Re: Cannot connect to SharePoint 2010 instance Ok, you can download a dev build at: http://people.apache.org/~kwright/apache-manifoldcf-1.1-dev It takes me about an hour to put one of these together, so if you can possibly build ManifoldCF yourself that would be a huge help. Karl On Mon, Nov 26, 2012 at 11:12 AM, Iannetti, Robert robert.ianne...@novartis.com wrote: That would be great please let me know when it is available Thanks Bob -Original Message- From: Karl Wright [mailto:daddy...@gmail.com] Sent: Monday, November 26, 2012 10:59 AM To: user@manifoldcf.apache.org Subject: Re: Cannot connect to SharePoint 2010 instance Hi Robert, I can build a binary version you can download, but not until tonight. It may be easier to talk through getting a build environment set up on your Linux machine. Is this Debian or Ubuntu linux, by any chance? If so, the setup is trivial and I can help you with that. Karl On Mon, Nov 26, 2012 at 10:12 AM, Iannetti, Robert robert.ianne...@novartis.com wrote: Karl, Is there a binary release (pre -compiled version) of the manifold trunk mentioned below https://svn.apache.org/repos/asf/manifoldcf/trunk that you can point me to I am new to Linux and don't have any experience with ANT. Thanks Bob -Original Message- From: Karl Wright [mailto:daddy...@gmail.com] Sent: Monday, November 26, 2012 4:32 AM To: user@manifoldcf.apache.org Subject: Re: Cannot connect to SharePoint 2010 instance I've done further research on HttpComponents' support for Kerberos. It turns out that HttpComponents claims they can successfully use tickets from the local machine's ticket store. I haven't tried this here (don't have the setup for it), but it looks like it could conceivably work with MCF trunk at this point. Read up on it here: http://hc.apache.org/httpcomponents-client-ga/tutorial/html/authentic a tion.html Ideally, of course, we'd really want to add the ability for ManifoldCF to handle its own ticket cache, one per connection, so that each connection looks like its own independent client. In order for that to happen, connectors that support Kerberos would need to be able to kerberos authenticate. But, for right now, this may work for people needing Kerberos. Karl On Sun, Nov 11, 2012 at 8:42 AM, Karl Wright daddy...@gmail.com wrote: The port of the SharePoint connector to httpcomponents 4.2.2 is complete. I don't know whether it will help you or not, but if you check out ManifoldCF trunk (from https://svn.apache.org/repos/asf/manifoldcf/trunk) and run: ant make-core-deps build ... you will be running the latest code. It has been tried against a plain-vanilla SharePoint system using standard NTLM and found to work. If you try the new code and it works for you, that would be very interesting to know; it looks like httpcomponents has developed some support for SPNEGO, which may be what is missing in the current ManifoldCF release. Thanks, Karl On Wed, Nov 7, 2012 at 4:47 PM, Karl Wright daddy...@gmail.com wrote: MCPermissions.asmx and Lists.asmx are two different services, and the Lists.asmx is likely failing before the MCPermissions.asmx is even needed. If, for instance, you are just trying with the UI to see if you get back Connection working, this makes sense since
Re: Cannot connect to SharePoint 2010 instance
The file is usually called logging.ini, and is referenced by the main manifoldcf properties file. Karl On Tue, Nov 27, 2012 at 1:06 PM, Iannetti, Robert robert.ianne...@novartis.com wrote: Karl, Where is the logging properties file where I would add the debugging commands located ? Thanks Bob -Original Message- From: Karl Wright [mailto:daddy...@gmail.com] Sent: Tuesday, November 27, 2012 12:52 PM To: user@manifoldcf.apache.org Subject: Re: Cannot connect to SharePoint 2010 instance Hi Bob, If the headers all check out, then maybe this is the cause: http://technet.microsoft.com/en-us/library/dd566199%28v=ws.10%29.aspx I will have to check the httpcomponents code to verify that it uses at least 128-bit encryption. I won't be able to do that until tonight or tomorrow though. Karl On Tue, Nov 27, 2012 at 11:36 AM, Karl Wright daddy...@gmail.com wrote: Hi Bob, This is really beginning to sound like there is a header problem of some kind. This is what I'd like to try. (1) Turn on wire debugging for SharePoint, as described here: https://cwiki.apache.org/confluence/display/CONNECTORS/Debugging+Conne ctions (2) Using curl, try to use post and the proper credentials, using the -vvv switch. If you successfully connect, save that output. Then try to EXACTLY mimic the request that ManifoldCF does, and if that FAILS record that output and send it all to me. Thanks! Karl On Tue, Nov 27, 2012 at 11:22 AM, Iannetti, Robert robert.ianne...@novartis.com wrote: Hi Karl, I have installed the dev version of the connector from below and am having an issue connecting to my SharePoint 2010 site. It actually seems similar to what is happening in your thread with Luigi. I try to log in to the sharepoint site as a user with full control and I get this error Crawl user did not authenticate properly, or has insufficient permissions to access http://...: (401)HTTP/1.1 401 Unauthorized Thanks Bob -Original Message- From: Karl Wright [mailto:daddy...@gmail.com] Sent: Monday, November 26, 2012 6:38 PM To: user@manifoldcf.apache.org Subject: Re: Cannot connect to SharePoint 2010 instance Ok, you can download a dev build at: http://people.apache.org/~kwright/apache-manifoldcf-1.1-dev It takes me about an hour to put one of these together, so if you can possibly build ManifoldCF yourself that would be a huge help. Karl On Mon, Nov 26, 2012 at 11:12 AM, Iannetti, Robert robert.ianne...@novartis.com wrote: That would be great please let me know when it is available Thanks Bob -Original Message- From: Karl Wright [mailto:daddy...@gmail.com] Sent: Monday, November 26, 2012 10:59 AM To: user@manifoldcf.apache.org Subject: Re: Cannot connect to SharePoint 2010 instance Hi Robert, I can build a binary version you can download, but not until tonight. It may be easier to talk through getting a build environment set up on your Linux machine. Is this Debian or Ubuntu linux, by any chance? If so, the setup is trivial and I can help you with that. Karl On Mon, Nov 26, 2012 at 10:12 AM, Iannetti, Robert robert.ianne...@novartis.com wrote: Karl, Is there a binary release (pre -compiled version) of the manifold trunk mentioned below https://svn.apache.org/repos/asf/manifoldcf/trunk that you can point me to I am new to Linux and don't have any experience with ANT. Thanks Bob -Original Message- From: Karl Wright [mailto:daddy...@gmail.com] Sent: Monday, November 26, 2012 4:32 AM To: user@manifoldcf.apache.org Subject: Re: Cannot connect to SharePoint 2010 instance I've done further research on HttpComponents' support for Kerberos. It turns out that HttpComponents claims they can successfully use tickets from the local machine's ticket store. I haven't tried this here (don't have the setup for it), but it looks like it could conceivably work with MCF trunk at this point. Read up on it here: http://hc.apache.org/httpcomponents-client-ga/tutorial/html/authent ic a tion.html Ideally, of course, we'd really want to add the ability for ManifoldCF to handle its own ticket cache, one per connection, so that each connection looks like its own independent client. In order for that to happen, connectors that support Kerberos would need to be able to kerberos authenticate. But, for right now, this may work for people needing Kerberos. Karl On Sun, Nov 11, 2012 at 8:42 AM, Karl Wright daddy...@gmail.com wrote: The port of the SharePoint connector to httpcomponents 4.2.2 is complete. I don't know whether it will help you or not, but if you check out ManifoldCF trunk (from https://svn.apache.org/repos/asf/manifoldcf/trunk) and run: ant make-core-deps build ... you will be running the latest code. It has been tried against a plain-vanilla SharePoint system using standard NTLM and found to work. If you try the new code and it works
RE: Cannot connect to SharePoint 2010 instance
Karl, It's odd I added this to the properties.xml file property name=org.apache.manifoldcf.connectors value=DEBUG/ And this to the logging.ini file log4j.logger.httpclient.wire=DEBUG I restarted manifold but nothing is being written to the manifoldcf.log file Any thoughts? Here is the curl data [iannero1@ip-10-145-32-121 logs]$ curl --data POST --ntlm -u nanet\\iannero1 http://searchpoc.testprojects.nibr.novartis.intra/_vti_bin/MCPermissions.asmx -v Enter host password for user 'nanet\iannero1': * About to connect() to searchpoc.testprojects.nibr.novartis.intra port 80 (#0) * Trying 160.62.169.185... connected * Connected to searchpoc.testprojects.nibr.novartis.intra (160.62.169.185) port 80 (#0) * Initializing NSS with certpath: sql:/etc/pki/nssdb * Server auth using NTLM with user 'nanet\iannero1' POST /_vti_bin/MCPermissions.asmx HTTP/1.1 Authorization: NTLM TlRMTVNTUAABBoIIAAA= User-Agent: curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.13.1.0 zlib/1.2.3 libidn/1.18 libssh2/1.2.2 Host: searchpoc.testprojects.nibr.novartis.intra Accept: */* Content-Length: 0 Content-Type: application/x-www-form-urlencoded HTTP/1.1 401 Unauthorized Server: Microsoft-IIS/7.5 SPRequestGuid: f7b8f5a5-1de4-43d1-9b70-7adf3b7d5987 WWW-Authenticate: NTLM TlRMTVNTUAACBwAHADgGgokClVhQpcbj++YAAMoAygA/BgGxHQ9OSUJSTkVUAgAOAE4ASQBCAFIATgBFAFQAAQAYAE4AUgBVAFMAQwBBAC0AUwBEADAANwA5AAQAIgBuAGkAYgByAC4AbgBvAHYAYQByAHQAaQBzAC4AbgBlAHQAAwA8AE4AUgBVAFMAQwBBAC0AUwBEADAANwA5AC4AbgBpAGIAcgAuAG4AbwB2AGEAcgB0AGkAcwAuAG4AZQB0AAUAIgBuAGkAYgByAC4AbgBvAHYAYQByAHQAaQBzAC4AbgBlAHQABwAIAA9MVPbLzM0BAA== X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 14.0.0.6123 X-MS-InvokeApp: 1; RequireReadOnly Date: Tue, 27 Nov 2012 18:21:04 GMT Content-Length: 0 * Connection #0 to host searchpoc.testprojects.nibr.novartis.intra left intact * Issue another request to this URL: 'http://searchpoc.testprojects.nibr.novartis.intra/_vti_bin/MCPermissions.asmx' * Re-using existing connection! (#0) with host searchpoc.testprojects.nibr.novartis.intra * Connected to searchpoc.testprojects.nibr.novartis.intra (160.62.169.185) port 80 (#0) * Server auth using NTLM with user 'nanet\iannero1' POST /_vti_bin/MCPermissions.asmx HTTP/1.1 Authorization: NTLM TlRMTVNTUAADGAAYAEAYABgAWAUABQBwCAAIAHUQABAAfQAABoKJApbX61a3hdN3ANfyrXuxF91dkEOBT5GMXTvsPdHWkjT6rm5hbmV0aWFubmVybzFpcC0xMC0xNDUtMzItMTIx User-Agent: curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.13.1.0 zlib/1.2.3 libidn/1.18 libssh2/1.2.2 Host: searchpoc.testprojects.nibr.novartis.intra Accept: */* Content-Length: 4 Content-Type: application/x-www-form-urlencoded HTTP/1.1 500 Internal Server Error Cache-Control: private Content-Type: application/soap+xml; charset=utf-8 Server: Microsoft-IIS/7.5 X-AspNet-Version: 2.0.50727 Persistent-Auth: true X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 14.0.0.6123 X-MS-InvokeApp: 1; RequireReadOnly Date: Tue, 27 Nov 2012 18:21:04 GMT Content-Length: 509 * Connection #0 to host searchpoc.testprojects.nibr.novartis.intra left intact * Closing connection #0 ?xml version=1.0 encoding=utf-8?soap:Envelope xmlns:soap=http://www.w3.org/2003/05/soap-envelope; xmlns:xsi=http://www.w3.org/2001/XMLSchema-instance; xmlns:xsd=http://www.w3.org/2001/XMLSchema;soap:Bodysoap:Faultsoap:Codesoap:Valuesoap:Receiver/soap:Value/soap:Codesoap:Reasonsoap:Text xml:lang=enServer was unable to process request. ---gt; Data at the root level is invalid. Line 1, position 1./soap:Text/soap:Reasonsoap:Detail //soap:Fault/soap:Body/soap:Envelope[iannero1@ip-10-145-32-121 logs]$ -Original Message- From: Karl Wright [mailto:daddy...@gmail.com] Sent: Tuesday, November 27, 2012 1:10 PM To: user@manifoldcf.apache.org Subject: Re: Cannot connect to SharePoint 2010 instance The file is usually called logging.ini, and is referenced by the main manifoldcf properties file. Karl On Tue, Nov 27, 2012 at 1:06 PM, Iannetti, Robert robert.ianne...@novartis.com wrote: Karl, Where is the logging properties file where I would add the debugging commands located ? Thanks Bob -Original Message- From: Karl Wright [mailto:daddy...@gmail.com] Sent: Tuesday, November 27, 2012 12:52 PM To: user@manifoldcf.apache.org Subject: Re: Cannot connect to SharePoint 2010 instance Hi Bob, If the headers all check out, then maybe this is the cause: http://technet.microsoft.com/en-us/library/dd566199%28v=ws.10%29.aspx I will have to check the httpcomponents code to verify that it uses at least 128-bit encryption. I won't be able to do that until tonight or tomorrow though. Karl On Tue, Nov 27, 2012 at 11:36 AM, Karl Wright daddy...@gmail.com wrote: Hi Bob, This is really beginning to sound like there is a header problem of some kind. This is what I'd like to try. (1) Turn on wire debugging
Re: Cannot connect to SharePoint 2010 instance
The wire debugging setup you are using will only work with commons-httpclient, not the new httpcomponent package. I'll have to do some research and see if there's a comparable logger setting for that package. Karl On Tue, Nov 27, 2012 at 2:01 PM, Iannetti, Robert robert.ianne...@novartis.com wrote: Karl, It's odd I added this to the properties.xml file property name=org.apache.manifoldcf.connectors value=DEBUG/ And this to the logging.ini file log4j.logger.httpclient.wire=DEBUG I restarted manifold but nothing is being written to the manifoldcf.log file Any thoughts? Here is the curl data [iannero1@ip-10-145-32-121 logs]$ curl --data POST --ntlm -u nanet\\iannero1 http://searchpoc.testprojects.nibr.novartis.intra/_vti_bin/MCPermissions.asmx -v Enter host password for user 'nanet\iannero1': * About to connect() to searchpoc.testprojects.nibr.novartis.intra port 80 (#0) * Trying 160.62.169.185... connected * Connected to searchpoc.testprojects.nibr.novartis.intra (160.62.169.185) port 80 (#0) * Initializing NSS with certpath: sql:/etc/pki/nssdb * Server auth using NTLM with user 'nanet\iannero1' POST /_vti_bin/MCPermissions.asmx HTTP/1.1 Authorization: NTLM TlRMTVNTUAABBoIIAAA= User-Agent: curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.13.1.0 zlib/1.2.3 libidn/1.18 libssh2/1.2.2 Host: searchpoc.testprojects.nibr.novartis.intra Accept: */* Content-Length: 0 Content-Type: application/x-www-form-urlencoded HTTP/1.1 401 Unauthorized Server: Microsoft-IIS/7.5 SPRequestGuid: f7b8f5a5-1de4-43d1-9b70-7adf3b7d5987 WWW-Authenticate: NTLM TlRMTVNTUAACBwAHADgGgokClVhQpcbj++YAAMoAygA/BgGxHQ9OSUJSTkVUAgAOAE4ASQBCAFIATgBFAFQAAQAYAE4AUgBVAFMAQwBBAC0AUwBEADAANwA5AAQAIgBuAGkAYgByAC4AbgBvAHYAYQByAHQAaQBzAC4AbgBlAHQAAwA8AE4AUgBVAFMAQwBBAC0AUwBEADAANwA5AC4AbgBpAGIAcgAuAG4AbwB2AGEAcgB0AGkAcwAuAG4AZQB0AAUAIgBuAGkAYgByAC4AbgBvAHYAYQByAHQAaQBzAC4AbgBlAHQABwAIAA9MVPbLzM0BAA== X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 14.0.0.6123 X-MS-InvokeApp: 1; RequireReadOnly Date: Tue, 27 Nov 2012 18:21:04 GMT Content-Length: 0 * Connection #0 to host searchpoc.testprojects.nibr.novartis.intra left intact * Issue another request to this URL: 'http://searchpoc.testprojects.nibr.novartis.intra/_vti_bin/MCPermissions.asmx' * Re-using existing connection! (#0) with host searchpoc.testprojects.nibr.novartis.intra * Connected to searchpoc.testprojects.nibr.novartis.intra (160.62.169.185) port 80 (#0) * Server auth using NTLM with user 'nanet\iannero1' POST /_vti_bin/MCPermissions.asmx HTTP/1.1 Authorization: NTLM TlRMTVNTUAADGAAYAEAYABgAWAUABQBwCAAIAHUQABAAfQAABoKJApbX61a3hdN3ANfyrXuxF91dkEOBT5GMXTvsPdHWkjT6rm5hbmV0aWFubmVybzFpcC0xMC0xNDUtMzItMTIx User-Agent: curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.13.1.0 zlib/1.2.3 libidn/1.18 libssh2/1.2.2 Host: searchpoc.testprojects.nibr.novartis.intra Accept: */* Content-Length: 4 Content-Type: application/x-www-form-urlencoded HTTP/1.1 500 Internal Server Error Cache-Control: private Content-Type: application/soap+xml; charset=utf-8 Server: Microsoft-IIS/7.5 X-AspNet-Version: 2.0.50727 Persistent-Auth: true X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 14.0.0.6123 X-MS-InvokeApp: 1; RequireReadOnly Date: Tue, 27 Nov 2012 18:21:04 GMT Content-Length: 509 * Connection #0 to host searchpoc.testprojects.nibr.novartis.intra left intact * Closing connection #0 ?xml version=1.0 encoding=utf-8?soap:Envelope xmlns:soap=http://www.w3.org/2003/05/soap-envelope; xmlns:xsi=http://www.w3.org/2001/XMLSchema-instance; xmlns:xsd=http://www.w3.org/2001/XMLSchema;soap:Bodysoap:Faultsoap:Codesoap:Valuesoap:Receiver/soap:Value/soap:Codesoap:Reasonsoap:Text xml:lang=enServer was unable to process request. ---gt; Data at the root level is invalid. Line 1, position 1./soap:Text/soap:Reasonsoap:Detail //soap:Fault/soap:Body/soap:Envelope[iannero1@ip-10-145-32-121 logs]$ -Original Message- From: Karl Wright [mailto:daddy...@gmail.com] Sent: Tuesday, November 27, 2012 1:10 PM To: user@manifoldcf.apache.org Subject: Re: Cannot connect to SharePoint 2010 instance The file is usually called logging.ini, and is referenced by the main manifoldcf properties file. Karl On Tue, Nov 27, 2012 at 1:06 PM, Iannetti, Robert robert.ianne...@novartis.com wrote: Karl, Where is the logging properties file where I would add the debugging commands located ? Thanks Bob -Original Message- From: Karl Wright [mailto:daddy...@gmail.com] Sent: Tuesday, November 27, 2012 12:52 PM To: user@manifoldcf.apache.org Subject: Re: Cannot connect to SharePoint 2010 instance Hi Bob, If the headers all check out, then maybe this is the cause: http://technet.microsoft.com/en-us/library/dd566199%28v=ws.10%29.aspx I will have to check
RE: Cannot connect to SharePoint 2010 instance
OK Thanks -Original Message- From: Karl Wright [mailto:daddy...@gmail.com] Sent: Tuesday, November 27, 2012 2:05 PM To: user@manifoldcf.apache.org Subject: Re: Cannot connect to SharePoint 2010 instance The wire debugging setup you are using will only work with commons-httpclient, not the new httpcomponent package. I'll have to do some research and see if there's a comparable logger setting for that package. Karl On Tue, Nov 27, 2012 at 2:01 PM, Iannetti, Robert robert.ianne...@novartis.com wrote: Karl, It's odd I added this to the properties.xml file property name=org.apache.manifoldcf.connectors value=DEBUG/ And this to the logging.ini file log4j.logger.httpclient.wire=DEBUG I restarted manifold but nothing is being written to the manifoldcf.log file Any thoughts? Here is the curl data [iannero1@ip-10-145-32-121 logs]$ curl --data POST --ntlm -u nanet\\iannero1 http://searchpoc.testprojects.nibr.novartis.intra/_vti_bin/MCPermissions.asmx -v Enter host password for user 'nanet\iannero1': * About to connect() to searchpoc.testprojects.nibr.novartis.intra port 80 (#0) * Trying 160.62.169.185... connected * Connected to searchpoc.testprojects.nibr.novartis.intra (160.62.169.185) port 80 (#0) * Initializing NSS with certpath: sql:/etc/pki/nssdb * Server auth using NTLM with user 'nanet\iannero1' POST /_vti_bin/MCPermissions.asmx HTTP/1.1 Authorization: NTLM TlRMTVNTUAABBoIIAAA= User-Agent: curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.13.1.0 zlib/1.2.3 libidn/1.18 libssh2/1.2.2 Host: searchpoc.testprojects.nibr.novartis.intra Accept: */* Content-Length: 0 Content-Type: application/x-www-form-urlencoded HTTP/1.1 401 Unauthorized Server: Microsoft-IIS/7.5 SPRequestGuid: f7b8f5a5-1de4-43d1-9b70-7adf3b7d5987 WWW-Authenticate: NTLM TlRMTVNTUAACBwAHADgGgokClVhQpcbj++YAAMoAygA/BgGxHQ 9OSUJSTkVUAgAOAE4ASQBCAFIATgBFAFQAAQAYAE4AUgBVAFMAQwBBAC0AUwBEADAA NwA5AAQAIgBuAGkAYgByAC4AbgBvAHYAYQByAHQAaQBzAC4AbgBlAHQAAwA8AE4AUgBVAF MAQwBBAC0AUwBEADAANwA5AC4AbgBpAGIAcgAuAG4AbwB2AGEAcgB0AGkAcwAuAG4AZQB0 AAUAIgBuAGkAYgByAC4AbgBvAHYAYQByAHQAaQBzAC4AbgBlAHQABwAIAA9MVPbLzM0BAA == X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 14.0.0.6123 X-MS-InvokeApp: 1; RequireReadOnly Date: Tue, 27 Nov 2012 18:21:04 GMT Content-Length: 0 * Connection #0 to host searchpoc.testprojects.nibr.novartis.intra left intact * Issue another request to this URL: 'http://searchpoc.testprojects.nibr.novartis.intra/_vti_bin/MCPermissions.asmx' * Re-using existing connection! (#0) with host searchpoc.testprojects.nibr.novartis.intra * Connected to searchpoc.testprojects.nibr.novartis.intra (160.62.169.185) port 80 (#0) * Server auth using NTLM with user 'nanet\iannero1' POST /_vti_bin/MCPermissions.asmx HTTP/1.1 Authorization: NTLM TlRMTVNTUAADGAAYAEAYABgAWAUABQBwCAAIAHUQABAAfQAAA AAABoKJApbX61a3hdN3ANfyrXuxF91dkEOBT5GMXT vsPdHWkjT6rm5hbmV0aWFubmVybzFpcC0xMC0xNDUtMzItMTIx User-Agent: curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.13.1.0 zlib/1.2.3 libidn/1.18 libssh2/1.2.2 Host: searchpoc.testprojects.nibr.novartis.intra Accept: */* Content-Length: 4 Content-Type: application/x-www-form-urlencoded HTTP/1.1 500 Internal Server Error Cache-Control: private Content-Type: application/soap+xml; charset=utf-8 Server: Microsoft-IIS/7.5 X-AspNet-Version: 2.0.50727 Persistent-Auth: true X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 14.0.0.6123 X-MS-InvokeApp: 1; RequireReadOnly Date: Tue, 27 Nov 2012 18:21:04 GMT Content-Length: 509 * Connection #0 to host searchpoc.testprojects.nibr.novartis.intra left intact * Closing connection #0 ?xml version=1.0 encoding=utf-8?soap:Envelope xmlns:soap=http://www.w3.org/2003/05/soap-envelope; xmlns:xsi=http://www.w3.org/2001/XMLSchema-instance; xmlns:xsd=http://www.w3.org/2001/XMLSchema;soap:Bodysoap:Faults oap:Codesoap:Valuesoap:Receiver/soap:Value/soap:Codesoap:Reaso nsoap:Text xml:lang=enServer was unable to process request. ---gt; Data at the root level is invalid. Line 1, position 1./soap:Text/soap:Reasonsoap:Detail //soap:Fault/soap:Body/soap:Envelope[iannero1@ip-10-145-32-121 logs]$ -Original Message- From: Karl Wright [mailto:daddy...@gmail.com] Sent: Tuesday, November 27, 2012 1:10 PM To: user@manifoldcf.apache.org Subject: Re: Cannot connect to SharePoint 2010 instance The file is usually called logging.ini, and is referenced by the main manifoldcf properties file. Karl On Tue, Nov 27, 2012 at 1:06 PM, Iannetti, Robert robert.ianne...@novartis.com wrote: Karl, Where is the logging properties file where I would add the debugging commands located ? Thanks Bob -Original Message- From: Karl Wright [mailto:daddy...@gmail.com] Sent: Tuesday, November 27, 2012 12:52 PM To: user
Re: Cannot connect to SharePoint 2010 instance
Here we go: Header logging: org.apache.http.headers=DEBUG Wire logging (which we probably don't need): org.apache.http.wire=DEBUG Karl On Tue, Nov 27, 2012 at 2:04 PM, Karl Wright daddy...@gmail.com wrote: The wire debugging setup you are using will only work with commons-httpclient, not the new httpcomponent package. I'll have to do some research and see if there's a comparable logger setting for that package. Karl On Tue, Nov 27, 2012 at 2:01 PM, Iannetti, Robert robert.ianne...@novartis.com wrote: Karl, It's odd I added this to the properties.xml file property name=org.apache.manifoldcf.connectors value=DEBUG/ And this to the logging.ini file log4j.logger.httpclient.wire=DEBUG I restarted manifold but nothing is being written to the manifoldcf.log file Any thoughts? Here is the curl data [iannero1@ip-10-145-32-121 logs]$ curl --data POST --ntlm -u nanet\\iannero1 http://searchpoc.testprojects.nibr.novartis.intra/_vti_bin/MCPermissions.asmx -v Enter host password for user 'nanet\iannero1': * About to connect() to searchpoc.testprojects.nibr.novartis.intra port 80 (#0) * Trying 160.62.169.185... connected * Connected to searchpoc.testprojects.nibr.novartis.intra (160.62.169.185) port 80 (#0) * Initializing NSS with certpath: sql:/etc/pki/nssdb * Server auth using NTLM with user 'nanet\iannero1' POST /_vti_bin/MCPermissions.asmx HTTP/1.1 Authorization: NTLM TlRMTVNTUAABBoIIAAA= User-Agent: curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.13.1.0 zlib/1.2.3 libidn/1.18 libssh2/1.2.2 Host: searchpoc.testprojects.nibr.novartis.intra Accept: */* Content-Length: 0 Content-Type: application/x-www-form-urlencoded HTTP/1.1 401 Unauthorized Server: Microsoft-IIS/7.5 SPRequestGuid: f7b8f5a5-1de4-43d1-9b70-7adf3b7d5987 WWW-Authenticate: NTLM TlRMTVNTUAACBwAHADgGgokClVhQpcbj++YAAMoAygA/BgGxHQ9OSUJSTkVUAgAOAE4ASQBCAFIATgBFAFQAAQAYAE4AUgBVAFMAQwBBAC0AUwBEADAANwA5AAQAIgBuAGkAYgByAC4AbgBvAHYAYQByAHQAaQBzAC4AbgBlAHQAAwA8AE4AUgBVAFMAQwBBAC0AUwBEADAANwA5AC4AbgBpAGIAcgAuAG4AbwB2AGEAcgB0AGkAcwAuAG4AZQB0AAUAIgBuAGkAYgByAC4AbgBvAHYAYQByAHQAaQBzAC4AbgBlAHQABwAIAA9MVPbLzM0BAA== X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 14.0.0.6123 X-MS-InvokeApp: 1; RequireReadOnly Date: Tue, 27 Nov 2012 18:21:04 GMT Content-Length: 0 * Connection #0 to host searchpoc.testprojects.nibr.novartis.intra left intact * Issue another request to this URL: 'http://searchpoc.testprojects.nibr.novartis.intra/_vti_bin/MCPermissions.asmx' * Re-using existing connection! (#0) with host searchpoc.testprojects.nibr.novartis.intra * Connected to searchpoc.testprojects.nibr.novartis.intra (160.62.169.185) port 80 (#0) * Server auth using NTLM with user 'nanet\iannero1' POST /_vti_bin/MCPermissions.asmx HTTP/1.1 Authorization: NTLM TlRMTVNTUAADGAAYAEAYABgAWAUABQBwCAAIAHUQABAAfQAABoKJApbX61a3hdN3ANfyrXuxF91dkEOBT5GMXTvsPdHWkjT6rm5hbmV0aWFubmVybzFpcC0xMC0xNDUtMzItMTIx User-Agent: curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.13.1.0 zlib/1.2.3 libidn/1.18 libssh2/1.2.2 Host: searchpoc.testprojects.nibr.novartis.intra Accept: */* Content-Length: 4 Content-Type: application/x-www-form-urlencoded HTTP/1.1 500 Internal Server Error Cache-Control: private Content-Type: application/soap+xml; charset=utf-8 Server: Microsoft-IIS/7.5 X-AspNet-Version: 2.0.50727 Persistent-Auth: true X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 14.0.0.6123 X-MS-InvokeApp: 1; RequireReadOnly Date: Tue, 27 Nov 2012 18:21:04 GMT Content-Length: 509 * Connection #0 to host searchpoc.testprojects.nibr.novartis.intra left intact * Closing connection #0 ?xml version=1.0 encoding=utf-8?soap:Envelope xmlns:soap=http://www.w3.org/2003/05/soap-envelope; xmlns:xsi=http://www.w3.org/2001/XMLSchema-instance; xmlns:xsd=http://www.w3.org/2001/XMLSchema;soap:Bodysoap:Faultsoap:Codesoap:Valuesoap:Receiver/soap:Value/soap:Codesoap:Reasonsoap:Text xml:lang=enServer was unable to process request. ---gt; Data at the root level is invalid. Line 1, position 1./soap:Text/soap:Reasonsoap:Detail //soap:Fault/soap:Body/soap:Envelope[iannero1@ip-10-145-32-121 logs]$ -Original Message- From: Karl Wright [mailto:daddy...@gmail.com] Sent: Tuesday, November 27, 2012 1:10 PM To: user@manifoldcf.apache.org Subject: Re: Cannot connect to SharePoint 2010 instance The file is usually called logging.ini, and is referenced by the main manifoldcf properties file. Karl On Tue, Nov 27, 2012 at 1:06 PM, Iannetti, Robert robert.ianne...@novartis.com wrote: Karl, Where is the logging properties file where I would add the debugging commands located ? Thanks Bob -Original Message- From: Karl Wright [mailto:daddy...@gmail.com] Sent: Tuesday, November 27, 2012 12:52 PM To: user@manifoldcf.apache.org
RE: Cannot connect to SharePoint 2010 instance
So would the org.apache.http.headers=DEBUG replace the log4j.logger.httpclient.wire=DEBUG entry in the logging.ini file? -Original Message- From: Karl Wright [mailto:daddy...@gmail.com] Sent: Tuesday, November 27, 2012 2:07 PM To: user@manifoldcf.apache.org Subject: Re: Cannot connect to SharePoint 2010 instance Here we go: Header logging: org.apache.http.headers=DEBUG Wire logging (which we probably don't need): org.apache.http.wire=DEBUG Karl On Tue, Nov 27, 2012 at 2:04 PM, Karl Wright daddy...@gmail.com wrote: The wire debugging setup you are using will only work with commons-httpclient, not the new httpcomponent package. I'll have to do some research and see if there's a comparable logger setting for that package. Karl On Tue, Nov 27, 2012 at 2:01 PM, Iannetti, Robert robert.ianne...@novartis.com wrote: Karl, It's odd I added this to the properties.xml file property name=org.apache.manifoldcf.connectors value=DEBUG/ And this to the logging.ini file log4j.logger.httpclient.wire=DEBUG I restarted manifold but nothing is being written to the manifoldcf.log file Any thoughts? Here is the curl data [iannero1@ip-10-145-32-121 logs]$ curl --data POST --ntlm -u nanet\\iannero1 http://searchpoc.testprojects.nibr.novartis.intra/_vti_bin/MCPermissions.asmx -v Enter host password for user 'nanet\iannero1': * About to connect() to searchpoc.testprojects.nibr.novartis.intra port 80 (#0) * Trying 160.62.169.185... connected * Connected to searchpoc.testprojects.nibr.novartis.intra (160.62.169.185) port 80 (#0) * Initializing NSS with certpath: sql:/etc/pki/nssdb * Server auth using NTLM with user 'nanet\iannero1' POST /_vti_bin/MCPermissions.asmx HTTP/1.1 Authorization: NTLM TlRMTVNTUAABBoIIAAA= User-Agent: curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.13.1.0 zlib/1.2.3 libidn/1.18 libssh2/1.2.2 Host: searchpoc.testprojects.nibr.novartis.intra Accept: */* Content-Length: 0 Content-Type: application/x-www-form-urlencoded HTTP/1.1 401 Unauthorized Server: Microsoft-IIS/7.5 SPRequestGuid: f7b8f5a5-1de4-43d1-9b70-7adf3b7d5987 WWW-Authenticate: NTLM TlRMTVNTUAACBwAHADgGgokClVhQpcbj++YAAMoAygA/BgGxH Q9OSUJSTkVUAgAOAE4ASQBCAFIATgBFAFQAAQAYAE4AUgBVAFMAQwBBAC0AUwBEAD AANwA5AAQAIgBuAGkAYgByAC4AbgBvAHYAYQByAHQAaQBzAC4AbgBlAHQAAwA8AE4AUgB VAFMAQwBBAC0AUwBEADAANwA5AC4AbgBpAGIAcgAuAG4AbwB2AGEAcgB0AGkAcwAuAG4A ZQB0AAUAIgBuAGkAYgByAC4AbgBvAHYAYQByAHQAaQBzAC4AbgBlAHQABwAIAA9MVPbLz M0BAA== X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 14.0.0.6123 X-MS-InvokeApp: 1; RequireReadOnly Date: Tue, 27 Nov 2012 18:21:04 GMT Content-Length: 0 * Connection #0 to host searchpoc.testprojects.nibr.novartis.intra left intact * Issue another request to this URL: 'http://searchpoc.testprojects.nibr.novartis.intra/_vti_bin/MCPermissions.asmx' * Re-using existing connection! (#0) with host searchpoc.testprojects.nibr.novartis.intra * Connected to searchpoc.testprojects.nibr.novartis.intra (160.62.169.185) port 80 (#0) * Server auth using NTLM with user 'nanet\iannero1' POST /_vti_bin/MCPermissions.asmx HTTP/1.1 Authorization: NTLM TlRMTVNTUAADGAAYAEAYABgAWAUABQBwCAAIAHUQABAAfQAA BoKJApbX61a3hdN3ANfyrXuxF91dkEOBT5GM XTvsPdHWkjT6rm5hbmV0aWFubmVybzFpcC0xMC0xNDUtMzItMTIx User-Agent: curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.13.1.0 zlib/1.2.3 libidn/1.18 libssh2/1.2.2 Host: searchpoc.testprojects.nibr.novartis.intra Accept: */* Content-Length: 4 Content-Type: application/x-www-form-urlencoded HTTP/1.1 500 Internal Server Error Cache-Control: private Content-Type: application/soap+xml; charset=utf-8 Server: Microsoft-IIS/7.5 X-AspNet-Version: 2.0.50727 Persistent-Auth: true X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 14.0.0.6123 X-MS-InvokeApp: 1; RequireReadOnly Date: Tue, 27 Nov 2012 18:21:04 GMT Content-Length: 509 * Connection #0 to host searchpoc.testprojects.nibr.novartis.intra left intact * Closing connection #0 ?xml version=1.0 encoding=utf-8?soap:Envelope xmlns:soap=http://www.w3.org/2003/05/soap-envelope; xmlns:xsi=http://www.w3.org/2001/XMLSchema-instance; xmlns:xsd=http://www.w3.org/2001/XMLSchema;soap:Bodysoap:Fault soap:Codesoap:Valuesoap:Receiver/soap:Value/soap:Codesoap:Rea sonsoap:Text xml:lang=enServer was unable to process request. ---gt; Data at the root level is invalid. Line 1, position 1./soap:Text/soap:Reasonsoap:Detail //soap:Fault/soap:Body/soap:Envelope[iannero1@ip-10-145-32-121 logs]$ -Original Message- From: Karl Wright [mailto:daddy...@gmail.com] Sent: Tuesday, November 27, 2012 1:10 PM To: user@manifoldcf.apache.org Subject: Re: Cannot connect to SharePoint 2010 instance The file is usually called logging.ini, and is referenced by the main manifoldcf properties file. Karl
Re: Cannot connect to SharePoint 2010 instance
Yes. Karl On Tue, Nov 27, 2012 at 2:14 PM, Iannetti, Robert robert.ianne...@novartis.com wrote: So would the org.apache.http.headers=DEBUG replace the log4j.logger.httpclient.wire=DEBUG entry in the logging.ini file? -Original Message- From: Karl Wright [mailto:daddy...@gmail.com] Sent: Tuesday, November 27, 2012 2:07 PM To: user@manifoldcf.apache.org Subject: Re: Cannot connect to SharePoint 2010 instance Here we go: Header logging: org.apache.http.headers=DEBUG Wire logging (which we probably don't need): org.apache.http.wire=DEBUG Karl On Tue, Nov 27, 2012 at 2:04 PM, Karl Wright daddy...@gmail.com wrote: The wire debugging setup you are using will only work with commons-httpclient, not the new httpcomponent package. I'll have to do some research and see if there's a comparable logger setting for that package. Karl On Tue, Nov 27, 2012 at 2:01 PM, Iannetti, Robert robert.ianne...@novartis.com wrote: Karl, It's odd I added this to the properties.xml file property name=org.apache.manifoldcf.connectors value=DEBUG/ And this to the logging.ini file log4j.logger.httpclient.wire=DEBUG I restarted manifold but nothing is being written to the manifoldcf.log file Any thoughts? Here is the curl data [iannero1@ip-10-145-32-121 logs]$ curl --data POST --ntlm -u nanet\\iannero1 http://searchpoc.testprojects.nibr.novartis.intra/_vti_bin/MCPermissions.asmx -v Enter host password for user 'nanet\iannero1': * About to connect() to searchpoc.testprojects.nibr.novartis.intra port 80 (#0) * Trying 160.62.169.185... connected * Connected to searchpoc.testprojects.nibr.novartis.intra (160.62.169.185) port 80 (#0) * Initializing NSS with certpath: sql:/etc/pki/nssdb * Server auth using NTLM with user 'nanet\iannero1' POST /_vti_bin/MCPermissions.asmx HTTP/1.1 Authorization: NTLM TlRMTVNTUAABBoIIAAA= User-Agent: curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.13.1.0 zlib/1.2.3 libidn/1.18 libssh2/1.2.2 Host: searchpoc.testprojects.nibr.novartis.intra Accept: */* Content-Length: 0 Content-Type: application/x-www-form-urlencoded HTTP/1.1 401 Unauthorized Server: Microsoft-IIS/7.5 SPRequestGuid: f7b8f5a5-1de4-43d1-9b70-7adf3b7d5987 WWW-Authenticate: NTLM TlRMTVNTUAACBwAHADgGgokClVhQpcbj++YAAMoAygA/BgGxH Q9OSUJSTkVUAgAOAE4ASQBCAFIATgBFAFQAAQAYAE4AUgBVAFMAQwBBAC0AUwBEAD AANwA5AAQAIgBuAGkAYgByAC4AbgBvAHYAYQByAHQAaQBzAC4AbgBlAHQAAwA8AE4AUgB VAFMAQwBBAC0AUwBEADAANwA5AC4AbgBpAGIAcgAuAG4AbwB2AGEAcgB0AGkAcwAuAG4A ZQB0AAUAIgBuAGkAYgByAC4AbgBvAHYAYQByAHQAaQBzAC4AbgBlAHQABwAIAA9MVPbLz M0BAA== X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 14.0.0.6123 X-MS-InvokeApp: 1; RequireReadOnly Date: Tue, 27 Nov 2012 18:21:04 GMT Content-Length: 0 * Connection #0 to host searchpoc.testprojects.nibr.novartis.intra left intact * Issue another request to this URL: 'http://searchpoc.testprojects.nibr.novartis.intra/_vti_bin/MCPermissions.asmx' * Re-using existing connection! (#0) with host searchpoc.testprojects.nibr.novartis.intra * Connected to searchpoc.testprojects.nibr.novartis.intra (160.62.169.185) port 80 (#0) * Server auth using NTLM with user 'nanet\iannero1' POST /_vti_bin/MCPermissions.asmx HTTP/1.1 Authorization: NTLM TlRMTVNTUAADGAAYAEAYABgAWAUABQBwCAAIAHUQABAAfQAA BoKJApbX61a3hdN3ANfyrXuxF91dkEOBT5GM XTvsPdHWkjT6rm5hbmV0aWFubmVybzFpcC0xMC0xNDUtMzItMTIx User-Agent: curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.13.1.0 zlib/1.2.3 libidn/1.18 libssh2/1.2.2 Host: searchpoc.testprojects.nibr.novartis.intra Accept: */* Content-Length: 4 Content-Type: application/x-www-form-urlencoded HTTP/1.1 500 Internal Server Error Cache-Control: private Content-Type: application/soap+xml; charset=utf-8 Server: Microsoft-IIS/7.5 X-AspNet-Version: 2.0.50727 Persistent-Auth: true X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 14.0.0.6123 X-MS-InvokeApp: 1; RequireReadOnly Date: Tue, 27 Nov 2012 18:21:04 GMT Content-Length: 509 * Connection #0 to host searchpoc.testprojects.nibr.novartis.intra left intact * Closing connection #0 ?xml version=1.0 encoding=utf-8?soap:Envelope xmlns:soap=http://www.w3.org/2003/05/soap-envelope; xmlns:xsi=http://www.w3.org/2001/XMLSchema-instance; xmlns:xsd=http://www.w3.org/2001/XMLSchema;soap:Bodysoap:Fault soap:Codesoap:Valuesoap:Receiver/soap:Value/soap:Codesoap:Rea sonsoap:Text xml:lang=enServer was unable to process request. ---gt; Data at the root level is invalid. Line 1, position 1./soap:Text/soap:Reasonsoap:Detail //soap:Fault/soap:Body/soap:Envelope[iannero1@ip-10-145-32-121 logs]$ -Original Message- From: Karl Wright [mailto:daddy...@gmail.com] Sent: Tuesday, November 27, 2012 1:10 PM To: user@manifoldcf.apache.org Subject: Re: Cannot connect to SharePoint 2010 instance The file is usually called
RE: Cannot connect to SharePoint 2010 instance
Karl,
I added the parameter to the logging.ini file and I am still not seeing any
data written to the log
# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements. See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to You under the Apache License, Version 2.0
# (the License); you may not use this file except in compliance with
# the License. You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an AS IS BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
log4j.appender.MAIN.File=logs/manifoldcf.log
log4j.rootLogger=WARN, MAIN
log4j.appender.MAIN=org.apache.log4j.RollingFileAppender
log4j.appender.MAIN.layout=org.apache.log4j.PatternLayout
log4j.appender.MAIN.layout.ConversionPattern=%5p %d{ISO8601} (%t) - %m%n
# add additional logging
org.apache.http.headers=DEBUG
-Original Message-
From: Karl Wright [mailto:daddy...@gmail.com]
Sent: Tuesday, November 27, 2012 3:20 PM
To: user@manifoldcf.apache.org
Subject: Re: Cannot connect to SharePoint 2010 instance
Yes.
Karl
On Tue, Nov 27, 2012 at 2:14 PM, Iannetti, Robert
robert.ianne...@novartis.com wrote:
So would the org.apache.http.headers=DEBUG replace the
log4j.logger.httpclient.wire=DEBUG entry in the logging.ini file?
-Original Message-
From: Karl Wright [mailto:daddy...@gmail.com]
Sent: Tuesday, November 27, 2012 2:07 PM
To: user@manifoldcf.apache.org
Subject: Re: Cannot connect to SharePoint 2010 instance
Here we go:
Header logging: org.apache.http.headers=DEBUG Wire logging (which we
probably don't need): org.apache.http.wire=DEBUG
Karl
On Tue, Nov 27, 2012 at 2:04 PM, Karl Wright daddy...@gmail.com wrote:
The wire debugging setup you are using will only work with
commons-httpclient, not the new httpcomponent package. I'll have to
do some research and see if there's a comparable logger setting for
that package.
Karl
On Tue, Nov 27, 2012 at 2:01 PM, Iannetti, Robert
robert.ianne...@novartis.com wrote:
Karl,
It's odd I added this to the properties.xml file property
name=org.apache.manifoldcf.connectors value=DEBUG/
And this to the logging.ini file
log4j.logger.httpclient.wire=DEBUG
I restarted manifold but nothing is being written to the
manifoldcf.log file
Any thoughts?
Here is the curl data
[iannero1@ip-10-145-32-121 logs]$ curl --data POST --ntlm -u
nanet\\iannero1
http://searchpoc.testprojects.nibr.novartis.intra/_vti_bin/MCPermissions.asmx
-v Enter host password for user 'nanet\iannero1':
* About to connect() to searchpoc.testprojects.nibr.novartis.intra port 80
(#0)
* Trying 160.62.169.185... connected
* Connected to searchpoc.testprojects.nibr.novartis.intra
(160.62.169.185) port 80 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
* Server auth using NTLM with user 'nanet\iannero1'
POST /_vti_bin/MCPermissions.asmx HTTP/1.1
Authorization: NTLM TlRMTVNTUAABBoIIAAA=
User-Agent: curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7
NSS/3.13.1.0 zlib/1.2.3 libidn/1.18 libssh2/1.2.2
Host: searchpoc.testprojects.nibr.novartis.intra
Accept: */*
Content-Length: 0
Content-Type: application/x-www-form-urlencoded
HTTP/1.1 401 Unauthorized
Server: Microsoft-IIS/7.5
SPRequestGuid: f7b8f5a5-1de4-43d1-9b70-7adf3b7d5987
WWW-Authenticate: NTLM
TlRMTVNTUAACBwAHADgGgokClVhQpcbj++YAAMoAygA/BgGx
TlRMTVNTUAACBwAHADgGgokClVhQpcbj++H
Q9OSUJSTkVUAgAOAE4ASQBCAFIATgBFAFQAAQAYAE4AUgBVAFMAQwBBAC0AUwBEA
D
AANwA5AAQAIgBuAGkAYgByAC4AbgBvAHYAYQByAHQAaQBzAC4AbgBlAHQAAwA8AE4AUg
B
VAFMAQwBBAC0AUwBEADAANwA5AC4AbgBpAGIAcgAuAG4AbwB2AGEAcgB0AGkAcwAuAG4
A
ZQB0AAUAIgBuAGkAYgByAC4AbgBvAHYAYQByAHQAaQBzAC4AbgBlAHQABwAIAA9MVPbL
z
M0BAA==
X-Powered-By: ASP.NET
MicrosoftSharePointTeamServices: 14.0.0.6123 X-MS-InvokeApp: 1;
RequireReadOnly Date: Tue, 27 Nov 2012 18:21:04 GMT
Content-Length: 0
* Connection #0 to host searchpoc.testprojects.nibr.novartis.intra
left intact
* Issue another request to this URL:
'http://searchpoc.testprojects.nibr.novartis.intra/_vti_bin/MCPermissions.asmx'
* Re-using existing connection! (#0) with host
searchpoc.testprojects.nibr.novartis.intra
* Connected to searchpoc.testprojects.nibr.novartis.intra
(160.62.169.185) port 80 (#0)
* Server auth using NTLM with user 'nanet\iannero1'
POST /_vti_bin/MCPermissions.asmx HTTP/1.1
Authorization: NTLM
TlRMTVNTUAADGAAYAEAYABgAWAUABQBwCAAIAHUQABAAfQA
A
BoKJApbX61a3hdN3ANfyrXuxF91dkEOBT5G
M
Re: Cannot connect to SharePoint 2010 instance
I've done further research on HttpComponents' support for Kerberos. It turns out that HttpComponents claims they can successfully use tickets from the local machine's ticket store. I haven't tried this here (don't have the setup for it), but it looks like it could conceivably work with MCF trunk at this point. Read up on it here: http://hc.apache.org/httpcomponents-client-ga/tutorial/html/authentication.html Ideally, of course, we'd really want to add the ability for ManifoldCF to handle its own ticket cache, one per connection, so that each connection looks like its own independent client. In order for that to happen, connectors that support Kerberos would need to be able to kerberos authenticate. But, for right now, this may work for people needing Kerberos. Karl On Sun, Nov 11, 2012 at 8:42 AM, Karl Wright daddy...@gmail.com wrote: The port of the SharePoint connector to httpcomponents 4.2.2 is complete. I don't know whether it will help you or not, but if you check out ManifoldCF trunk (from https://svn.apache.org/repos/asf/manifoldcf/trunk) and run: ant make-core-deps build ... you will be running the latest code. It has been tried against a plain-vanilla SharePoint system using standard NTLM and found to work. If you try the new code and it works for you, that would be very interesting to know; it looks like httpcomponents has developed some support for SPNEGO, which may be what is missing in the current ManifoldCF release. Thanks, Karl On Wed, Nov 7, 2012 at 4:47 PM, Karl Wright daddy...@gmail.com wrote: MCPermissions.asmx and Lists.asmx are two different services, and the Lists.asmx is likely failing before the MCPermissions.asmx is even needed. If, for instance, you are just trying with the UI to see if you get back Connection working, this makes sense since the Lists service is called first and then the MCPermissions service is called after. FWIW, I'm starting to look into porting ManifoldCF to the httpcomponent libraries from the older httpclient 3.1 world. This will make it easier, I think, to incorporate newer additions. Thanks, Karl On Wed, Nov 7, 2012 at 3:44 PM, Iannetti, Robert robert.ianne...@novartis.com wrote: Karl, It looks like I am failing connecting to the /_vti_bin/lists.asmx service but I never see the MCPermissions.asmx in any of my trace logs. Why is that? Thanks Bob -Original Message- From: Iannetti, Robert Sent: Wednesday, November 07, 2012 10:37 AM To: user@manifoldcf.apache.org Subject: RE: Cannot connect to SharePoint 2010 instance Karl, The X's you see are me trying to make the log look generic there were valid guids present in the real log. I will try WireShark and let you know the results. Thanks Bob -Original Message- From: Karl Wright [mailto:daddy...@gmail.com] Sent: Wednesday, November 07, 2012 10:32 AM To: user@manifoldcf.apache.org Subject: Re: Cannot connect to SharePoint 2010 instance This in general looks like a proper NTLM authorization sequence, except for the lack of confirmation at the end. The only thing I see that I don't recognize is this: DEBUG 2012-11-07 09:56:11,212 (Thread-441) - SPRequestGuid: xxx[\r][\n] If SharePoint is expecting this GUID to be returned somehow then that would explain it, but frankly we've got a number of SP 2010 installations and that hasn't been an issue anywhere else. And, I don't expect curl would work if that was the case. It's worth a shot using a tool like WireShark to see if you can find any difference in headers etc. between curl and ManifoldCF. We've noticed in the past that the exact Host header seems to be the critical issue, so any differences there would be of interest. Karl On Wed, Nov 7, 2012 at 10:08 AM, Iannetti, Robert robert.ianne...@novartis.com wrote: Karl, We have created the NTLM SharePoint instance as instructed. The Curl command is now responding when before it would not. curl --ntlm -u domain\\username http://xxx.xxx.xxx.xxx/_vti_bin/MCPermissions.asmx -v But we are still getting an error when issuing the connection request from the ManifoldCF GUI Crawl user did not authenticate properly, or has insufficient permissions to access http://XXX.XXX.XXX.XXX: (401)Unauthorized From the log file DEBUG 2012-11-07 09:56:11,126 (Thread-441) - POST /_vti_bin/lists.asmx HTTP/1.1[\r][\n] DEBUG 2012-11-07 09:56:11,151 (Thread-441) - Content-Type: text/xml; charset=utf-8[\r][\n] DEBUG 2012-11-07 09:56:11,152 (Thread-441) - SOAPAction: http://schemas.microsoft.com/sharepoint/soap/GetListCollection[\r][\n]; DEBUG 2012-11-07 09:56:11,152 (Thread-441) - User-Agent: Axis/1.4[\r][\n] DEBUG 2012-11-07 09:56:11,152 (Thread-441) - Host: x...[\r][\n] DEBUG 2012-11-07 09:56:11,152 (Thread-441) - Transfer-Encoding: chunked[\r][\n] DEBUG 2012-11-07 09:56:11,152 (Thread-441) - [\r][\n] DEBUG 2012-11-07 09:56:11,153 (Thread-441) - 14f
RE: Cannot connect to SharePoint 2010 instance
Thanks Karl I will have a look -Original Message- From: Karl Wright [mailto:daddy...@gmail.com] Sent: Monday, November 26, 2012 4:32 AM To: user@manifoldcf.apache.org Subject: Re: Cannot connect to SharePoint 2010 instance I've done further research on HttpComponents' support for Kerberos. It turns out that HttpComponents claims they can successfully use tickets from the local machine's ticket store. I haven't tried this here (don't have the setup for it), but it looks like it could conceivably work with MCF trunk at this point. Read up on it here: http://hc.apache.org/httpcomponents-client-ga/tutorial/html/authentication.html Ideally, of course, we'd really want to add the ability for ManifoldCF to handle its own ticket cache, one per connection, so that each connection looks like its own independent client. In order for that to happen, connectors that support Kerberos would need to be able to kerberos authenticate. But, for right now, this may work for people needing Kerberos. Karl On Sun, Nov 11, 2012 at 8:42 AM, Karl Wright daddy...@gmail.com wrote: The port of the SharePoint connector to httpcomponents 4.2.2 is complete. I don't know whether it will help you or not, but if you check out ManifoldCF trunk (from https://svn.apache.org/repos/asf/manifoldcf/trunk) and run: ant make-core-deps build ... you will be running the latest code. It has been tried against a plain-vanilla SharePoint system using standard NTLM and found to work. If you try the new code and it works for you, that would be very interesting to know; it looks like httpcomponents has developed some support for SPNEGO, which may be what is missing in the current ManifoldCF release. Thanks, Karl On Wed, Nov 7, 2012 at 4:47 PM, Karl Wright daddy...@gmail.com wrote: MCPermissions.asmx and Lists.asmx are two different services, and the Lists.asmx is likely failing before the MCPermissions.asmx is even needed. If, for instance, you are just trying with the UI to see if you get back Connection working, this makes sense since the Lists service is called first and then the MCPermissions service is called after. FWIW, I'm starting to look into porting ManifoldCF to the httpcomponent libraries from the older httpclient 3.1 world. This will make it easier, I think, to incorporate newer additions. Thanks, Karl On Wed, Nov 7, 2012 at 3:44 PM, Iannetti, Robert robert.ianne...@novartis.com wrote: Karl, It looks like I am failing connecting to the /_vti_bin/lists.asmx service but I never see the MCPermissions.asmx in any of my trace logs. Why is that? Thanks Bob -Original Message- From: Iannetti, Robert Sent: Wednesday, November 07, 2012 10:37 AM To: user@manifoldcf.apache.org Subject: RE: Cannot connect to SharePoint 2010 instance Karl, The X's you see are me trying to make the log look generic there were valid guids present in the real log. I will try WireShark and let you know the results. Thanks Bob -Original Message- From: Karl Wright [mailto:daddy...@gmail.com] Sent: Wednesday, November 07, 2012 10:32 AM To: user@manifoldcf.apache.org Subject: Re: Cannot connect to SharePoint 2010 instance This in general looks like a proper NTLM authorization sequence, except for the lack of confirmation at the end. The only thing I see that I don't recognize is this: DEBUG 2012-11-07 09:56:11,212 (Thread-441) - SPRequestGuid: xxx[\r][\n] If SharePoint is expecting this GUID to be returned somehow then that would explain it, but frankly we've got a number of SP 2010 installations and that hasn't been an issue anywhere else. And, I don't expect curl would work if that was the case. It's worth a shot using a tool like WireShark to see if you can find any difference in headers etc. between curl and ManifoldCF. We've noticed in the past that the exact Host header seems to be the critical issue, so any differences there would be of interest. Karl On Wed, Nov 7, 2012 at 10:08 AM, Iannetti, Robert robert.ianne...@novartis.com wrote: Karl, We have created the NTLM SharePoint instance as instructed. The Curl command is now responding when before it would not. curl --ntlm -u domain\\username http://xxx.xxx.xxx.xxx/_vti_bin/MCPermissions.asmx -v But we are still getting an error when issuing the connection request from the ManifoldCF GUI Crawl user did not authenticate properly, or has insufficient permissions to access http://XXX.XXX.XXX.XXX: (401)Unauthorized From the log file DEBUG 2012-11-07 09:56:11,126 (Thread-441) - POST /_vti_bin/lists.asmx HTTP/1.1[\r][\n] DEBUG 2012-11-07 09:56:11,151 (Thread-441) - Content-Type: text/xml; charset=utf-8[\r][\n] DEBUG 2012-11-07 09:56:11,152 (Thread-441) - SOAPAction: http://schemas.microsoft.com/sharepoint/soap/GetListCollection[\r][\n]; DEBUG 2012-11-07 09:56:11,152 (Thread-441) - User-Agent: Axis/1.4[\r][\n] DEBUG 2012-11-07
RE: Cannot connect to SharePoint 2010 instance
Karl, Is there a binary release (pre -compiled version) of the manifold trunk mentioned below https://svn.apache.org/repos/asf/manifoldcf/trunk that you can point me to I am new to Linux and don't have any experience with ANT. Thanks Bob -Original Message- From: Karl Wright [mailto:daddy...@gmail.com] Sent: Monday, November 26, 2012 4:32 AM To: user@manifoldcf.apache.org Subject: Re: Cannot connect to SharePoint 2010 instance I've done further research on HttpComponents' support for Kerberos. It turns out that HttpComponents claims they can successfully use tickets from the local machine's ticket store. I haven't tried this here (don't have the setup for it), but it looks like it could conceivably work with MCF trunk at this point. Read up on it here: http://hc.apache.org/httpcomponents-client-ga/tutorial/html/authentication.html Ideally, of course, we'd really want to add the ability for ManifoldCF to handle its own ticket cache, one per connection, so that each connection looks like its own independent client. In order for that to happen, connectors that support Kerberos would need to be able to kerberos authenticate. But, for right now, this may work for people needing Kerberos. Karl On Sun, Nov 11, 2012 at 8:42 AM, Karl Wright daddy...@gmail.com wrote: The port of the SharePoint connector to httpcomponents 4.2.2 is complete. I don't know whether it will help you or not, but if you check out ManifoldCF trunk (from https://svn.apache.org/repos/asf/manifoldcf/trunk) and run: ant make-core-deps build ... you will be running the latest code. It has been tried against a plain-vanilla SharePoint system using standard NTLM and found to work. If you try the new code and it works for you, that would be very interesting to know; it looks like httpcomponents has developed some support for SPNEGO, which may be what is missing in the current ManifoldCF release. Thanks, Karl On Wed, Nov 7, 2012 at 4:47 PM, Karl Wright daddy...@gmail.com wrote: MCPermissions.asmx and Lists.asmx are two different services, and the Lists.asmx is likely failing before the MCPermissions.asmx is even needed. If, for instance, you are just trying with the UI to see if you get back Connection working, this makes sense since the Lists service is called first and then the MCPermissions service is called after. FWIW, I'm starting to look into porting ManifoldCF to the httpcomponent libraries from the older httpclient 3.1 world. This will make it easier, I think, to incorporate newer additions. Thanks, Karl On Wed, Nov 7, 2012 at 3:44 PM, Iannetti, Robert robert.ianne...@novartis.com wrote: Karl, It looks like I am failing connecting to the /_vti_bin/lists.asmx service but I never see the MCPermissions.asmx in any of my trace logs. Why is that? Thanks Bob -Original Message- From: Iannetti, Robert Sent: Wednesday, November 07, 2012 10:37 AM To: user@manifoldcf.apache.org Subject: RE: Cannot connect to SharePoint 2010 instance Karl, The X's you see are me trying to make the log look generic there were valid guids present in the real log. I will try WireShark and let you know the results. Thanks Bob -Original Message- From: Karl Wright [mailto:daddy...@gmail.com] Sent: Wednesday, November 07, 2012 10:32 AM To: user@manifoldcf.apache.org Subject: Re: Cannot connect to SharePoint 2010 instance This in general looks like a proper NTLM authorization sequence, except for the lack of confirmation at the end. The only thing I see that I don't recognize is this: DEBUG 2012-11-07 09:56:11,212 (Thread-441) - SPRequestGuid: xxx[\r][\n] If SharePoint is expecting this GUID to be returned somehow then that would explain it, but frankly we've got a number of SP 2010 installations and that hasn't been an issue anywhere else. And, I don't expect curl would work if that was the case. It's worth a shot using a tool like WireShark to see if you can find any difference in headers etc. between curl and ManifoldCF. We've noticed in the past that the exact Host header seems to be the critical issue, so any differences there would be of interest. Karl On Wed, Nov 7, 2012 at 10:08 AM, Iannetti, Robert robert.ianne...@novartis.com wrote: Karl, We have created the NTLM SharePoint instance as instructed. The Curl command is now responding when before it would not. curl --ntlm -u domain\\username http://xxx.xxx.xxx.xxx/_vti_bin/MCPermissions.asmx -v But we are still getting an error when issuing the connection request from the ManifoldCF GUI Crawl user did not authenticate properly, or has insufficient permissions to access http://XXX.XXX.XXX.XXX: (401)Unauthorized From the log file DEBUG 2012-11-07 09:56:11,126 (Thread-441) - POST /_vti_bin/lists.asmx HTTP/1.1[\r][\n] DEBUG 2012-11-07 09:56:11,151 (Thread-441) - Content-Type: text/xml; charset=utf-8[\r][\n] DEBUG 2012-11-07
RE: Cannot connect to SharePoint 2010 instance
Karl, It looks like I am failing connecting to the /_vti_bin/lists.asmx service but I never see the MCPermissions.asmx in any of my trace logs. Why is that? Thanks Bob -Original Message- From: Iannetti, Robert Sent: Wednesday, November 07, 2012 10:37 AM To: user@manifoldcf.apache.org Subject: RE: Cannot connect to SharePoint 2010 instance Karl, The X's you see are me trying to make the log look generic there were valid guids present in the real log. I will try WireShark and let you know the results. Thanks Bob -Original Message- From: Karl Wright [mailto:daddy...@gmail.com] Sent: Wednesday, November 07, 2012 10:32 AM To: user@manifoldcf.apache.org Subject: Re: Cannot connect to SharePoint 2010 instance This in general looks like a proper NTLM authorization sequence, except for the lack of confirmation at the end. The only thing I see that I don't recognize is this: DEBUG 2012-11-07 09:56:11,212 (Thread-441) - SPRequestGuid: xxx[\r][\n] If SharePoint is expecting this GUID to be returned somehow then that would explain it, but frankly we've got a number of SP 2010 installations and that hasn't been an issue anywhere else. And, I don't expect curl would work if that was the case. It's worth a shot using a tool like WireShark to see if you can find any difference in headers etc. between curl and ManifoldCF. We've noticed in the past that the exact Host header seems to be the critical issue, so any differences there would be of interest. Karl On Wed, Nov 7, 2012 at 10:08 AM, Iannetti, Robert robert.ianne...@novartis.com wrote: Karl, We have created the NTLM SharePoint instance as instructed. The Curl command is now responding when before it would not. curl --ntlm -u domain\\username http://xxx.xxx.xxx.xxx/_vti_bin/MCPermissions.asmx -v But we are still getting an error when issuing the connection request from the ManifoldCF GUI Crawl user did not authenticate properly, or has insufficient permissions to access http://XXX.XXX.XXX.XXX: (401)Unauthorized From the log file DEBUG 2012-11-07 09:56:11,126 (Thread-441) - POST /_vti_bin/lists.asmx HTTP/1.1[\r][\n] DEBUG 2012-11-07 09:56:11,151 (Thread-441) - Content-Type: text/xml; charset=utf-8[\r][\n] DEBUG 2012-11-07 09:56:11,152 (Thread-441) - SOAPAction: http://schemas.microsoft.com/sharepoint/soap/GetListCollection[\r][\n]; DEBUG 2012-11-07 09:56:11,152 (Thread-441) - User-Agent: Axis/1.4[\r][\n] DEBUG 2012-11-07 09:56:11,152 (Thread-441) - Host: x...[\r][\n] DEBUG 2012-11-07 09:56:11,152 (Thread-441) - Transfer-Encoding: chunked[\r][\n] DEBUG 2012-11-07 09:56:11,152 (Thread-441) - [\r][\n] DEBUG 2012-11-07 09:56:11,153 (Thread-441) - 14f[\r][\n] DEBUG 2012-11-07 09:56:11,153 (Thread-441) - ?xml version=1.0 encoding=UTF-8?soapenv:Envelope xmlns:soapenv=http://schemas.xmlsoap.org/soap/envelope/; xmlns:xsd=http://www.w3.org/2001/XMLSchema; xmlns:xsi=http://www.w3.org/2001/XMLSchema-instance;soapenv:BodyGetListCollection xmlns=http://schemas.microsoft.com/sharepoint/soap///soapenv:Body/soapenv:Envelope DEBUG 2012-11-07 09:56:11,153 (Thread-441) - [\r][\n] DEBUG 2012-11-07 09:56:11,153 (Thread-441) - 0 DEBUG 2012-11-07 09:56:11,153 (Thread-441) - [\r][\n] DEBUG 2012-11-07 09:56:11,153 (Thread-441) - [\r][\n] DEBUG 2012-11-07 09:56:11,170 (Thread-441) - HTTP/1.1 401 Unauthorized[\r][\n] DEBUG 2012-11-07 09:56:11,171 (Thread-441) - Server: Microsoft-IIS/7.5[\r][\n] DEBUG 2012-11-07 09:56:11,171 (Thread-441) - SPRequestGuid: [\r][\n] DEBUG 2012-11-07 09:56:11,171 (Thread-441) - WWW-Authenticate: NTLM[\r][\n] DEBUG 2012-11-07 09:56:11,171 (Thread-441) - X-Powered-By: ASP.NET[\r][\n] DEBUG 2012-11-07 09:56:11,171 (Thread-441) - MicrosoftSharePointTeamServices: 14.0.0.6123[\r][\n] DEBUG 2012-11-07 09:56:11,172 (Thread-441) - X-MS-InvokeApp: 1; RequireReadOnly[\r][\n] DEBUG 2012-11-07 09:56:11,172 (Thread-441) - Date: Wed, 07 Nov 2012 14:56:10 GMT[\r][\n] DEBUG 2012-11-07 09:56:11,172 (Thread-441) - Content-Length: 0[\r][\n] DEBUG 2012-11-07 09:56:11,172 (Thread-441) - [\r][\n] DEBUG 2012-11-07 09:56:11,195 (Thread-441) - POST /_vti_bin/lists.asmx HTTP/1.1[\r][\n] DEBUG 2012-11-07 09:56:11,195 (Thread-441) - Content-Type: text/xml; charset=utf-8[\r][\n] DEBUG 2012-11-07 09:56:11,196 (Thread-441) - SOAPAction: http://schemas.microsoft.com/sharepoint/soap/GetListCollection[\r][\n]; DEBUG 2012-11-07 09:56:11,196 (Thread-441) - User-Agent: Axis/1.4[\r][\n] DEBUG 2012-11-07 09:56:11,196 (Thread-441) - Transfer-Encoding: chunked[\r][\n] DEBUG 2012-11-07 09:56:11,196 (Thread-441) - Authorization: NTLM xx[\r][\n] DEBUG 2012-11-07 09:56:11,196 (Thread-441) - Host: xxx.xxx.xxx.xxx[\r][\n] DEBUG 2012-11-07 09:56:11,196 (Thread-441) - [\r][\n] DEBUG 2012-11-07 09:56:11,196 (Thread-441) - 14f[\r][\n] DEBUG 2012-11-07 09:56:11,196 (Thread-441) - ?xml version=1.0
Re: Cannot connect to SharePoint 2010 instance
I've seen situations where a SharePoint site is configured to perform a redirection, and this is messing things up internally. Does the your connection server name etc. match precisely the URL you see when you are in the SharePoint user interface? Karl On Tue, Nov 6, 2012 at 8:47 AM, Iannetti, Robert robert.ianne...@novartis.com wrote: Karl, After further review it appears the MCpermissions.asmx was installed globally in SharePoint. I am able to access it from within my SharePoint site as well as all other valid SharePoint sub-sites. So this connection http://server/sitepath/_vti_bin works with any valid site in sitepath including the previously mentioned _admin site. That said do you have any thoughts on why I would be getting the 404 error? Thanks Bob -Original Message- From: Karl Wright [mailto:daddy...@gmail.com] Sent: Monday, November 05, 2012 2:45 PM To: user@manifoldcf.apache.org Subject: Re: Cannot connect to SharePoint 2010 instance The 404 error indicates that your MCPermissions service is not properly deployed. The _admin in your path is a clue that something might not be right. The place you want to see the MCPermissions.asmx is in the following location: http[s]://server/sitepath/_vti_bin ... where the server is your server name, and the sitepath is your site path. The best way to get this is to enter the SharePoint UI (NOT the admin UI, but the SharePoint end-user UI), and log into the root site. Then make note of the URL in your browser. If the MCPermissions.asmx service appears under that URL, look at your IIS settings and make sure that the MCPermissions.asmx service can be executed. Also, this may be of some help: https://cwiki.apache.org/confluence/display/CONNECTORS/Debugging+Connections The end user documentation is also extremely helpful in describing how to properly set up connections. You can uninstall the MCPermissions.asmx service using the .bat files that are included with the plugin. When you re-install, please make sure that you are logged in as a user with full admin privileges, or the service will not work properly. Thanks, Karl On Mon, Nov 5, 2012 at 2:33 PM, Iannetti, Robert robert.ianne...@novartis.com wrote: Hello, I have installed apache-manifoldcf-1.0.1 on my Linux server and apache-manifoldcf-sharepoint-2010-plugin-0.1-bin on my SharePoint 2010 server. On my SharePoint server I can see the Permissions Page when I enter http://x:x/_admin/_vti_bin/MCPermissions.asmx in my browser. When I try to make a SharePoint Services 4.0 (2010) connection to my SharePoint 2010 server in the ManifoldCF interface I get this error. Got an unknown remote exception accessing site - axis fault = Client, detail = The request failed with HTTP status 404: Not Found. I can connect using SharePoint Services 2.0 (2003) but when I try a crawl it does not work properly and aborts. The SharePoint Services 3.0 (2007) connection fails the same as the above 2010 connection. Can you please give some direction on how best to resolve this issue. Thanks Bob Robert P. Iannetti Application Architect Novartis Institute for BioMedical Research 186 Massachusetts Avenue Cambridge, MA 02139 Phone: +1 (617) 871-5414 robert.ianne...@novartis.com
RE: Cannot connect to SharePoint 2010 instance
Yes, The URL and what I enter in the ManifoldCF interface are a match. -Original Message- From: Karl Wright [mailto:daddy...@gmail.com] Sent: Tuesday, November 06, 2012 8:52 AM To: user@manifoldcf.apache.org Subject: Re: Cannot connect to SharePoint 2010 instance I've seen situations where a SharePoint site is configured to perform a redirection, and this is messing things up internally. Does the your connection server name etc. match precisely the URL you see when you are in the SharePoint user interface? Karl On Tue, Nov 6, 2012 at 8:47 AM, Iannetti, Robert robert.ianne...@novartis.com wrote: Karl, After further review it appears the MCpermissions.asmx was installed globally in SharePoint. I am able to access it from within my SharePoint site as well as all other valid SharePoint sub-sites. So this connection http://server/sitepath/_vti_bin works with any valid site in sitepath including the previously mentioned _admin site. That said do you have any thoughts on why I would be getting the 404 error? Thanks Bob -Original Message- From: Karl Wright [mailto:daddy...@gmail.com] Sent: Monday, November 05, 2012 2:45 PM To: user@manifoldcf.apache.org Subject: Re: Cannot connect to SharePoint 2010 instance The 404 error indicates that your MCPermissions service is not properly deployed. The _admin in your path is a clue that something might not be right. The place you want to see the MCPermissions.asmx is in the following location: http[s]://server/sitepath/_vti_bin ... where the server is your server name, and the sitepath is your site path. The best way to get this is to enter the SharePoint UI (NOT the admin UI, but the SharePoint end-user UI), and log into the root site. Then make note of the URL in your browser. If the MCPermissions.asmx service appears under that URL, look at your IIS settings and make sure that the MCPermissions.asmx service can be executed. Also, this may be of some help: https://cwiki.apache.org/confluence/display/CONNECTORS/Debugging+Conne ctions The end user documentation is also extremely helpful in describing how to properly set up connections. You can uninstall the MCPermissions.asmx service using the .bat files that are included with the plugin. When you re-install, please make sure that you are logged in as a user with full admin privileges, or the service will not work properly. Thanks, Karl On Mon, Nov 5, 2012 at 2:33 PM, Iannetti, Robert robert.ianne...@novartis.com wrote: Hello, I have installed apache-manifoldcf-1.0.1 on my Linux server and apache-manifoldcf-sharepoint-2010-plugin-0.1-bin on my SharePoint 2010 server. On my SharePoint server I can see the Permissions Page when I enter http://x:x/_admin/_vti_bin/MCPermissions.asmx in my browser. When I try to make a SharePoint Services 4.0 (2010) connection to my SharePoint 2010 server in the ManifoldCF interface I get this error. Got an unknown remote exception accessing site - axis fault = Client, detail = The request failed with HTTP status 404: Not Found. I can connect using SharePoint Services 2.0 (2003) but when I try a crawl it does not work properly and aborts. The SharePoint Services 3.0 (2007) connection fails the same as the above 2010 connection. Can you please give some direction on how best to resolve this issue. Thanks Bob Robert P. Iannetti Application Architect Novartis Institute for BioMedical Research 186 Massachusetts Avenue Cambridge, MA 02139 Phone: +1 (617) 871-5414 robert.ianne...@novartis.com
Re: Cannot connect to SharePoint 2010 instance
Yes, this can be somewhat tricky. There are a lot of potential configurations that could affect this. First, you want to verify that your IIS is using NTLM authentication, and that all the web services directories are executable. This is critical. Second, the credentials, in the form of domain\user, may be sensitive to whether you use a fully-qualified domain name or a shortcut domain name, e.g. mydomain.novartis.com or just mydomain. I suggest you try some combinations. The other thing you may want to check is whether the machine you are running ManifoldCF on is known by your domain controller; you may not be able to authenticate if it is not. If this doesn't help, and you want to eliminate ManifoldCF's NTLM implementation from the list of possibilities, I suggest downloading the curl utility, and trying to fetch a web service listing or wsdl using it (specifying NTLM of course as the authentication method). If that also doesn't work, it's a server-side configuration problem of some kind. You can also refer to the server-side IIS logs for some additional info. But I've found these are not very helpful for authentication issues. Let me know if you are still stuck after this; there are other diagnostics available but they start to get ugly. Kral On Tue, Nov 6, 2012 at 2:35 PM, Iannetti, Robert robert.ianne...@novartis.com wrote: Karl, I turned on the additional debugging and was able to resolve the 404 issue. Now I am getting: Crawl user did not authenticate properly, or has insufficient permissions to access http://.xxx.xxx: (401)Unauthorized I can log into the SharePoint site from the browser using the same credentials. Any Thoughts? Thanks Bob -Original Message- From: Karl Wright [mailto:daddy...@gmail.com] Sent: Tuesday, November 06, 2012 10:05 AM To: user@manifoldcf.apache.org Subject: Re: Cannot connect to SharePoint 2010 instance Well, you can turn on httpclient wire debugging, as I believe is described in the article URL I sent you before, and then you can see precisely what URL the connector is trying to reach when it accesses the MCPermissions service. There's no magic here. If the connector gets a 404 error back from IIS, either its URL is wrong, or IIS has decided it's not going to serve that page to the client. Karl On Tue, Nov 6, 2012 at 8:58 AM, Iannetti, Robert robert.ianne...@novartis.com wrote: Yes, The URL and what I enter in the ManifoldCF interface are a match. -Original Message- From: Karl Wright [mailto:daddy...@gmail.com] Sent: Tuesday, November 06, 2012 8:52 AM To: user@manifoldcf.apache.org Subject: Re: Cannot connect to SharePoint 2010 instance I've seen situations where a SharePoint site is configured to perform a redirection, and this is messing things up internally. Does the your connection server name etc. match precisely the URL you see when you are in the SharePoint user interface? Karl On Tue, Nov 6, 2012 at 8:47 AM, Iannetti, Robert robert.ianne...@novartis.com wrote: Karl, After further review it appears the MCpermissions.asmx was installed globally in SharePoint. I am able to access it from within my SharePoint site as well as all other valid SharePoint sub-sites. So this connection http://server/sitepath/_vti_bin works with any valid site in sitepath including the previously mentioned _admin site. That said do you have any thoughts on why I would be getting the 404 error? Thanks Bob -Original Message- From: Karl Wright [mailto:daddy...@gmail.com] Sent: Monday, November 05, 2012 2:45 PM To: user@manifoldcf.apache.org Subject: Re: Cannot connect to SharePoint 2010 instance The 404 error indicates that your MCPermissions service is not properly deployed. The _admin in your path is a clue that something might not be right. The place you want to see the MCPermissions.asmx is in the following location: http[s]://server/sitepath/_vti_bin ... where the server is your server name, and the sitepath is your site path. The best way to get this is to enter the SharePoint UI (NOT the admin UI, but the SharePoint end-user UI), and log into the root site. Then make note of the URL in your browser. If the MCPermissions.asmx service appears under that URL, look at your IIS settings and make sure that the MCPermissions.asmx service can be executed. Also, this may be of some help: https://cwiki.apache.org/confluence/display/CONNECTORS/Debugging+Conn e ctions The end user documentation is also extremely helpful in describing how to properly set up connections. You can uninstall the MCPermissions.asmx service using the .bat files that are included with the plugin. When you re-install, please make sure that you are logged in as a user with full admin privileges, or the service will not work properly. Thanks, Karl On Mon, Nov 5, 2012 at 2:33 PM, Iannetti, Robert robert.ianne...@novartis.com wrote: Hello, I have
Re: Cannot connect to SharePoint 2010 instance
No, Kerberos is not supported. This is a limitation of the Apache commons-httpclient library that we use for communicating with SharePoint. It is possible to set up IIS to serve a different port with different authentication that goes to the same SharePoint instance but is NTLM protected, not Kerberos protected. Perhaps you can do this and limit access to that port to only the ManifoldCF machine. Karl On Tue, Nov 6, 2012 at 3:03 PM, Iannetti, Robert robert.ianne...@novartis.com wrote: Karl, Our SharePoint sites use Kerberos authentication is this supported in ManifoldCF? Thanks Bob -Original Message- From: Karl Wright [mailto:daddy...@gmail.com] Sent: Tuesday, November 06, 2012 2:50 PM To: user@manifoldcf.apache.org Subject: Re: Cannot connect to SharePoint 2010 instance Yes, this can be somewhat tricky. There are a lot of potential configurations that could affect this. First, you want to verify that your IIS is using NTLM authentication, and that all the web services directories are executable. This is critical. Second, the credentials, in the form of domain\user, may be sensitive to whether you use a fully-qualified domain name or a shortcut domain name, e.g. mydomain.novartis.com or just mydomain. I suggest you try some combinations. The other thing you may want to check is whether the machine you are running ManifoldCF on is known by your domain controller; you may not be able to authenticate if it is not. If this doesn't help, and you want to eliminate ManifoldCF's NTLM implementation from the list of possibilities, I suggest downloading the curl utility, and trying to fetch a web service listing or wsdl using it (specifying NTLM of course as the authentication method). If that also doesn't work, it's a server-side configuration problem of some kind. You can also refer to the server-side IIS logs for some additional info. But I've found these are not very helpful for authentication issues. Let me know if you are still stuck after this; there are other diagnostics available but they start to get ugly. Kral On Tue, Nov 6, 2012 at 2:35 PM, Iannetti, Robert robert.ianne...@novartis.com wrote: Karl, I turned on the additional debugging and was able to resolve the 404 issue. Now I am getting: Crawl user did not authenticate properly, or has insufficient permissions to access http://.xxx.xxx: (401)Unauthorized I can log into the SharePoint site from the browser using the same credentials. Any Thoughts? Thanks Bob -Original Message- From: Karl Wright [mailto:daddy...@gmail.com] Sent: Tuesday, November 06, 2012 10:05 AM To: user@manifoldcf.apache.org Subject: Re: Cannot connect to SharePoint 2010 instance Well, you can turn on httpclient wire debugging, as I believe is described in the article URL I sent you before, and then you can see precisely what URL the connector is trying to reach when it accesses the MCPermissions service. There's no magic here. If the connector gets a 404 error back from IIS, either its URL is wrong, or IIS has decided it's not going to serve that page to the client. Karl On Tue, Nov 6, 2012 at 8:58 AM, Iannetti, Robert robert.ianne...@novartis.com wrote: Yes, The URL and what I enter in the ManifoldCF interface are a match. -Original Message- From: Karl Wright [mailto:daddy...@gmail.com] Sent: Tuesday, November 06, 2012 8:52 AM To: user@manifoldcf.apache.org Subject: Re: Cannot connect to SharePoint 2010 instance I've seen situations where a SharePoint site is configured to perform a redirection, and this is messing things up internally. Does the your connection server name etc. match precisely the URL you see when you are in the SharePoint user interface? Karl On Tue, Nov 6, 2012 at 8:47 AM, Iannetti, Robert robert.ianne...@novartis.com wrote: Karl, After further review it appears the MCpermissions.asmx was installed globally in SharePoint. I am able to access it from within my SharePoint site as well as all other valid SharePoint sub-sites. So this connection http://server/sitepath/_vti_bin works with any valid site in sitepath including the previously mentioned _admin site. That said do you have any thoughts on why I would be getting the 404 error? Thanks Bob -Original Message- From: Karl Wright [mailto:daddy...@gmail.com] Sent: Monday, November 05, 2012 2:45 PM To: user@manifoldcf.apache.org Subject: Re: Cannot connect to SharePoint 2010 instance The 404 error indicates that your MCPermissions service is not properly deployed. The _admin in your path is a clue that something might not be right. The place you want to see the MCPermissions.asmx is in the following location: http[s]://server/sitepath/_vti_bin ... where the server is your server name, and the sitepath is your site path. The best way to get this is to enter the SharePoint UI (NOT the admin UI
RE: Cannot connect to SharePoint 2010 instance
Karl, If this is not possible can you recommend any other products to crawl SharePoint content and index it in Solr? Thanks Bob -Original Message- From: Karl Wright [mailto:daddy...@gmail.com] Sent: Tuesday, November 06, 2012 3:10 PM To: user@manifoldcf.apache.org Subject: Re: Cannot connect to SharePoint 2010 instance No, Kerberos is not supported. This is a limitation of the Apache commons-httpclient library that we use for communicating with SharePoint. It is possible to set up IIS to serve a different port with different authentication that goes to the same SharePoint instance but is NTLM protected, not Kerberos protected. Perhaps you can do this and limit access to that port to only the ManifoldCF machine. Karl On Tue, Nov 6, 2012 at 3:03 PM, Iannetti, Robert robert.ianne...@novartis.com wrote: Karl, Our SharePoint sites use Kerberos authentication is this supported in ManifoldCF? Thanks Bob -Original Message- From: Karl Wright [mailto:daddy...@gmail.com] Sent: Tuesday, November 06, 2012 2:50 PM To: user@manifoldcf.apache.org Subject: Re: Cannot connect to SharePoint 2010 instance Yes, this can be somewhat tricky. There are a lot of potential configurations that could affect this. First, you want to verify that your IIS is using NTLM authentication, and that all the web services directories are executable. This is critical. Second, the credentials, in the form of domain\user, may be sensitive to whether you use a fully-qualified domain name or a shortcut domain name, e.g. mydomain.novartis.com or just mydomain. I suggest you try some combinations. The other thing you may want to check is whether the machine you are running ManifoldCF on is known by your domain controller; you may not be able to authenticate if it is not. If this doesn't help, and you want to eliminate ManifoldCF's NTLM implementation from the list of possibilities, I suggest downloading the curl utility, and trying to fetch a web service listing or wsdl using it (specifying NTLM of course as the authentication method). If that also doesn't work, it's a server-side configuration problem of some kind. You can also refer to the server-side IIS logs for some additional info. But I've found these are not very helpful for authentication issues. Let me know if you are still stuck after this; there are other diagnostics available but they start to get ugly. Kral On Tue, Nov 6, 2012 at 2:35 PM, Iannetti, Robert robert.ianne...@novartis.com wrote: Karl, I turned on the additional debugging and was able to resolve the 404 issue. Now I am getting: Crawl user did not authenticate properly, or has insufficient permissions to access http://.xxx.xxx: (401)Unauthorized I can log into the SharePoint site from the browser using the same credentials. Any Thoughts? Thanks Bob -Original Message- From: Karl Wright [mailto:daddy...@gmail.com] Sent: Tuesday, November 06, 2012 10:05 AM To: user@manifoldcf.apache.org Subject: Re: Cannot connect to SharePoint 2010 instance Well, you can turn on httpclient wire debugging, as I believe is described in the article URL I sent you before, and then you can see precisely what URL the connector is trying to reach when it accesses the MCPermissions service. There's no magic here. If the connector gets a 404 error back from IIS, either its URL is wrong, or IIS has decided it's not going to serve that page to the client. Karl On Tue, Nov 6, 2012 at 8:58 AM, Iannetti, Robert robert.ianne...@novartis.com wrote: Yes, The URL and what I enter in the ManifoldCF interface are a match. -Original Message- From: Karl Wright [mailto:daddy...@gmail.com] Sent: Tuesday, November 06, 2012 8:52 AM To: user@manifoldcf.apache.org Subject: Re: Cannot connect to SharePoint 2010 instance I've seen situations where a SharePoint site is configured to perform a redirection, and this is messing things up internally. Does the your connection server name etc. match precisely the URL you see when you are in the SharePoint user interface? Karl On Tue, Nov 6, 2012 at 8:47 AM, Iannetti, Robert robert.ianne...@novartis.com wrote: Karl, After further review it appears the MCpermissions.asmx was installed globally in SharePoint. I am able to access it from within my SharePoint site as well as all other valid SharePoint sub-sites. So this connection http://server/sitepath/_vti_bin works with any valid site in sitepath including the previously mentioned _admin site. That said do you have any thoughts on why I would be getting the 404 error? Thanks Bob -Original Message- From: Karl Wright [mailto:daddy...@gmail.com] Sent: Monday, November 05, 2012 2:45 PM To: user@manifoldcf.apache.org Subject: Re: Cannot connect to SharePoint 2010 instance The 404 error indicates that your MCPermissions service is not properly deployed. The _admin in your
Re: Cannot connect to SharePoint 2010 instance
Hi Bob, The only products I know have a similar limitations. The only one I know is the SharePoint google appliance connector, which when I looked last had exactly the same restriction. It also has other limitations, some severe, such as limiting the number of documents you can crawl to no more than 5000 per library. We are willing to do a reasonable amount of work to upgrade ManifoldCF to be able to support Kerberos. Here's a link which describes the situation: http://old.nabble.com/Support-for-Kerberos-SPNEGO-td14564857.html We currently use a significantly-patched version of 3.1, which supplied the NTLM implementation for 4.0 that is currently in use. Our issue is similar to the commons-httpclient team's, which is we have no good way of testing all of this, and none of us are security protocol experts. If you have (or know somebody with) such expertise, who would be willing/able to donate their time, this problem could be tackled I think without too much pain. So at least httpclient, given the right tickets, would be able to connect. The other issue with Kerberos auth is that I believe it will require a significant amount of work to allow anything using it to obtain the tickets from the AD domain controller. This would obviously require UI work for all connectors that would support Kerberos. But that is something I am willing to attempt if everything else is in place. Karl On Tue, Nov 6, 2012 at 3:11 PM, Iannetti, Robert robert.ianne...@novartis.com wrote: Karl, If this is not possible can you recommend any other products to crawl SharePoint content and index it in Solr? Thanks Bob -Original Message- From: Karl Wright [mailto:daddy...@gmail.com] Sent: Tuesday, November 06, 2012 3:10 PM To: user@manifoldcf.apache.org Subject: Re: Cannot connect to SharePoint 2010 instance No, Kerberos is not supported. This is a limitation of the Apache commons-httpclient library that we use for communicating with SharePoint. It is possible to set up IIS to serve a different port with different authentication that goes to the same SharePoint instance but is NTLM protected, not Kerberos protected. Perhaps you can do this and limit access to that port to only the ManifoldCF machine. Karl On Tue, Nov 6, 2012 at 3:03 PM, Iannetti, Robert robert.ianne...@novartis.com wrote: Karl, Our SharePoint sites use Kerberos authentication is this supported in ManifoldCF? Thanks Bob -Original Message- From: Karl Wright [mailto:daddy...@gmail.com] Sent: Tuesday, November 06, 2012 2:50 PM To: user@manifoldcf.apache.org Subject: Re: Cannot connect to SharePoint 2010 instance Yes, this can be somewhat tricky. There are a lot of potential configurations that could affect this. First, you want to verify that your IIS is using NTLM authentication, and that all the web services directories are executable. This is critical. Second, the credentials, in the form of domain\user, may be sensitive to whether you use a fully-qualified domain name or a shortcut domain name, e.g. mydomain.novartis.com or just mydomain. I suggest you try some combinations. The other thing you may want to check is whether the machine you are running ManifoldCF on is known by your domain controller; you may not be able to authenticate if it is not. If this doesn't help, and you want to eliminate ManifoldCF's NTLM implementation from the list of possibilities, I suggest downloading the curl utility, and trying to fetch a web service listing or wsdl using it (specifying NTLM of course as the authentication method). If that also doesn't work, it's a server-side configuration problem of some kind. You can also refer to the server-side IIS logs for some additional info. But I've found these are not very helpful for authentication issues. Let me know if you are still stuck after this; there are other diagnostics available but they start to get ugly. Kral On Tue, Nov 6, 2012 at 2:35 PM, Iannetti, Robert robert.ianne...@novartis.com wrote: Karl, I turned on the additional debugging and was able to resolve the 404 issue. Now I am getting: Crawl user did not authenticate properly, or has insufficient permissions to access http://.xxx.xxx: (401)Unauthorized I can log into the SharePoint site from the browser using the same credentials. Any Thoughts? Thanks Bob -Original Message- From: Karl Wright [mailto:daddy...@gmail.com] Sent: Tuesday, November 06, 2012 10:05 AM To: user@manifoldcf.apache.org Subject: Re: Cannot connect to SharePoint 2010 instance Well, you can turn on httpclient wire debugging, as I believe is described in the article URL I sent you before, and then you can see precisely what URL the connector is trying to reach when it accesses the MCPermissions service. There's no magic here. If the connector gets a 404 error back from IIS, either its URL is wrong, or IIS has decided it's not going
RE: Cannot connect to SharePoint 2010 instance
Karl, On another topic is there a roadmap for supporting SharePoint 2013 ? We are in the process of migrating and were wondering when your ManifoldCF product would be available to support it. Thanks Bob -Original Message- From: Karl Wright [mailto:daddy...@gmail.com] Sent: Tuesday, November 06, 2012 3:34 PM To: user@manifoldcf.apache.org Subject: Re: Cannot connect to SharePoint 2010 instance Hi Bob, The only products I know have a similar limitations. The only one I know is the SharePoint google appliance connector, which when I looked last had exactly the same restriction. It also has other limitations, some severe, such as limiting the number of documents you can crawl to no more than 5000 per library. We are willing to do a reasonable amount of work to upgrade ManifoldCF to be able to support Kerberos. Here's a link which describes the situation: http://old.nabble.com/Support-for-Kerberos-SPNEGO-td14564857.html We currently use a significantly-patched version of 3.1, which supplied the NTLM implementation for 4.0 that is currently in use. Our issue is similar to the commons-httpclient team's, which is we have no good way of testing all of this, and none of us are security protocol experts. If you have (or know somebody with) such expertise, who would be willing/able to donate their time, this problem could be tackled I think without too much pain. So at least httpclient, given the right tickets, would be able to connect. The other issue with Kerberos auth is that I believe it will require a significant amount of work to allow anything using it to obtain the tickets from the AD domain controller. This would obviously require UI work for all connectors that would support Kerberos. But that is something I am willing to attempt if everything else is in place. Karl On Tue, Nov 6, 2012 at 3:11 PM, Iannetti, Robert robert.ianne...@novartis.com wrote: Karl, If this is not possible can you recommend any other products to crawl SharePoint content and index it in Solr? Thanks Bob -Original Message- From: Karl Wright [mailto:daddy...@gmail.com] Sent: Tuesday, November 06, 2012 3:10 PM To: user@manifoldcf.apache.org Subject: Re: Cannot connect to SharePoint 2010 instance No, Kerberos is not supported. This is a limitation of the Apache commons-httpclient library that we use for communicating with SharePoint. It is possible to set up IIS to serve a different port with different authentication that goes to the same SharePoint instance but is NTLM protected, not Kerberos protected. Perhaps you can do this and limit access to that port to only the ManifoldCF machine. Karl On Tue, Nov 6, 2012 at 3:03 PM, Iannetti, Robert robert.ianne...@novartis.com wrote: Karl, Our SharePoint sites use Kerberos authentication is this supported in ManifoldCF? Thanks Bob -Original Message- From: Karl Wright [mailto:daddy...@gmail.com] Sent: Tuesday, November 06, 2012 2:50 PM To: user@manifoldcf.apache.org Subject: Re: Cannot connect to SharePoint 2010 instance Yes, this can be somewhat tricky. There are a lot of potential configurations that could affect this. First, you want to verify that your IIS is using NTLM authentication, and that all the web services directories are executable. This is critical. Second, the credentials, in the form of domain\user, may be sensitive to whether you use a fully-qualified domain name or a shortcut domain name, e.g. mydomain.novartis.com or just mydomain. I suggest you try some combinations. The other thing you may want to check is whether the machine you are running ManifoldCF on is known by your domain controller; you may not be able to authenticate if it is not. If this doesn't help, and you want to eliminate ManifoldCF's NTLM implementation from the list of possibilities, I suggest downloading the curl utility, and trying to fetch a web service listing or wsdl using it (specifying NTLM of course as the authentication method). If that also doesn't work, it's a server-side configuration problem of some kind. You can also refer to the server-side IIS logs for some additional info. But I've found these are not very helpful for authentication issues. Let me know if you are still stuck after this; there are other diagnostics available but they start to get ugly. Kral On Tue, Nov 6, 2012 at 2:35 PM, Iannetti, Robert robert.ianne...@novartis.com wrote: Karl, I turned on the additional debugging and was able to resolve the 404 issue. Now I am getting: Crawl user did not authenticate properly, or has insufficient permissions to access http://.xxx.xxx: (401)Unauthorized I can log into the SharePoint site from the browser using the same credentials. Any Thoughts? Thanks Bob -Original Message- From: Karl Wright [mailto:daddy...@gmail.com] Sent: Tuesday, November 06, 2012 10:05 AM To: user@manifoldcf.apache.org
Re: Cannot connect to SharePoint 2010 instance
Hi Bob, That depends very strongly on whether SharePoint 2013 continues the Microsoft tradition of breaking web services that used to work. :-) Seriously, we need three things to develop a SharePoint 2013 solution: (1) A stable release (a beta is not sufficient because Microsoft is famous for changing things in a major way between beta and release); (2) a benevolent client with sufficient patience to try things out that we develop in their environment, and (3) enough time so that we're not on the bleeding edge and that other people have run into most of the sticky problems first. We're volunteers here and we all have day jobs, so we mostly can't afford to be pounding away at brick walls on our own. It could be the case that everything just works, in which case the development is trivial. We'll have to see. Karl On Tue, Nov 6, 2012 at 3:37 PM, Iannetti, Robert robert.ianne...@novartis.com wrote: Karl, On another topic is there a roadmap for supporting SharePoint 2013 ? We are in the process of migrating and were wondering when your ManifoldCF product would be available to support it. Thanks Bob -Original Message- From: Karl Wright [mailto:daddy...@gmail.com] Sent: Tuesday, November 06, 2012 3:34 PM To: user@manifoldcf.apache.org Subject: Re: Cannot connect to SharePoint 2010 instance Hi Bob, The only products I know have a similar limitations. The only one I know is the SharePoint google appliance connector, which when I looked last had exactly the same restriction. It also has other limitations, some severe, such as limiting the number of documents you can crawl to no more than 5000 per library. We are willing to do a reasonable amount of work to upgrade ManifoldCF to be able to support Kerberos. Here's a link which describes the situation: http://old.nabble.com/Support-for-Kerberos-SPNEGO-td14564857.html We currently use a significantly-patched version of 3.1, which supplied the NTLM implementation for 4.0 that is currently in use. Our issue is similar to the commons-httpclient team's, which is we have no good way of testing all of this, and none of us are security protocol experts. If you have (or know somebody with) such expertise, who would be willing/able to donate their time, this problem could be tackled I think without too much pain. So at least httpclient, given the right tickets, would be able to connect. The other issue with Kerberos auth is that I believe it will require a significant amount of work to allow anything using it to obtain the tickets from the AD domain controller. This would obviously require UI work for all connectors that would support Kerberos. But that is something I am willing to attempt if everything else is in place. Karl On Tue, Nov 6, 2012 at 3:11 PM, Iannetti, Robert robert.ianne...@novartis.com wrote: Karl, If this is not possible can you recommend any other products to crawl SharePoint content and index it in Solr? Thanks Bob -Original Message- From: Karl Wright [mailto:daddy...@gmail.com] Sent: Tuesday, November 06, 2012 3:10 PM To: user@manifoldcf.apache.org Subject: Re: Cannot connect to SharePoint 2010 instance No, Kerberos is not supported. This is a limitation of the Apache commons-httpclient library that we use for communicating with SharePoint. It is possible to set up IIS to serve a different port with different authentication that goes to the same SharePoint instance but is NTLM protected, not Kerberos protected. Perhaps you can do this and limit access to that port to only the ManifoldCF machine. Karl On Tue, Nov 6, 2012 at 3:03 PM, Iannetti, Robert robert.ianne...@novartis.com wrote: Karl, Our SharePoint sites use Kerberos authentication is this supported in ManifoldCF? Thanks Bob -Original Message- From: Karl Wright [mailto:daddy...@gmail.com] Sent: Tuesday, November 06, 2012 2:50 PM To: user@manifoldcf.apache.org Subject: Re: Cannot connect to SharePoint 2010 instance Yes, this can be somewhat tricky. There are a lot of potential configurations that could affect this. First, you want to verify that your IIS is using NTLM authentication, and that all the web services directories are executable. This is critical. Second, the credentials, in the form of domain\user, may be sensitive to whether you use a fully-qualified domain name or a shortcut domain name, e.g. mydomain.novartis.com or just mydomain. I suggest you try some combinations. The other thing you may want to check is whether the machine you are running ManifoldCF on is known by your domain controller; you may not be able to authenticate if it is not. If this doesn't help, and you want to eliminate ManifoldCF's NTLM implementation from the list of possibilities, I suggest downloading the curl utility, and trying to fetch a web service listing or wsdl using it (specifying NTLM of course as the authentication method
RE: Cannot connect to SharePoint 2010 instance
Karl, That sounds reasonable. I am having my SP Admin set up the NTML SharePoint instance described below I will let you know how it works. BTW SP 2013 RTM has been released so we can cross #1 off the list :) Thanks Bob -Original Message- From: Karl Wright [mailto:daddy...@gmail.com] Sent: Tuesday, November 06, 2012 3:47 PM To: user@manifoldcf.apache.org Subject: Re: Cannot connect to SharePoint 2010 instance Hi Bob, That depends very strongly on whether SharePoint 2013 continues the Microsoft tradition of breaking web services that used to work. :-) Seriously, we need three things to develop a SharePoint 2013 solution: (1) A stable release (a beta is not sufficient because Microsoft is famous for changing things in a major way between beta and release); (2) a benevolent client with sufficient patience to try things out that we develop in their environment, and (3) enough time so that we're not on the bleeding edge and that other people have run into most of the sticky problems first. We're volunteers here and we all have day jobs, so we mostly can't afford to be pounding away at brick walls on our own. It could be the case that everything just works, in which case the development is trivial. We'll have to see. Karl On Tue, Nov 6, 2012 at 3:37 PM, Iannetti, Robert robert.ianne...@novartis.com wrote: Karl, On another topic is there a roadmap for supporting SharePoint 2013 ? We are in the process of migrating and were wondering when your ManifoldCF product would be available to support it. Thanks Bob -Original Message- From: Karl Wright [mailto:daddy...@gmail.com] Sent: Tuesday, November 06, 2012 3:34 PM To: user@manifoldcf.apache.org Subject: Re: Cannot connect to SharePoint 2010 instance Hi Bob, The only products I know have a similar limitations. The only one I know is the SharePoint google appliance connector, which when I looked last had exactly the same restriction. It also has other limitations, some severe, such as limiting the number of documents you can crawl to no more than 5000 per library. We are willing to do a reasonable amount of work to upgrade ManifoldCF to be able to support Kerberos. Here's a link which describes the situation: http://old.nabble.com/Support-for-Kerberos-SPNEGO-td14564857.html We currently use a significantly-patched version of 3.1, which supplied the NTLM implementation for 4.0 that is currently in use. Our issue is similar to the commons-httpclient team's, which is we have no good way of testing all of this, and none of us are security protocol experts. If you have (or know somebody with) such expertise, who would be willing/able to donate their time, this problem could be tackled I think without too much pain. So at least httpclient, given the right tickets, would be able to connect. The other issue with Kerberos auth is that I believe it will require a significant amount of work to allow anything using it to obtain the tickets from the AD domain controller. This would obviously require UI work for all connectors that would support Kerberos. But that is something I am willing to attempt if everything else is in place. Karl On Tue, Nov 6, 2012 at 3:11 PM, Iannetti, Robert robert.ianne...@novartis.com wrote: Karl, If this is not possible can you recommend any other products to crawl SharePoint content and index it in Solr? Thanks Bob -Original Message- From: Karl Wright [mailto:daddy...@gmail.com] Sent: Tuesday, November 06, 2012 3:10 PM To: user@manifoldcf.apache.org Subject: Re: Cannot connect to SharePoint 2010 instance No, Kerberos is not supported. This is a limitation of the Apache commons-httpclient library that we use for communicating with SharePoint. It is possible to set up IIS to serve a different port with different authentication that goes to the same SharePoint instance but is NTLM protected, not Kerberos protected. Perhaps you can do this and limit access to that port to only the ManifoldCF machine. Karl On Tue, Nov 6, 2012 at 3:03 PM, Iannetti, Robert robert.ianne...@novartis.com wrote: Karl, Our SharePoint sites use Kerberos authentication is this supported in ManifoldCF? Thanks Bob -Original Message- From: Karl Wright [mailto:daddy...@gmail.com] Sent: Tuesday, November 06, 2012 2:50 PM To: user@manifoldcf.apache.org Subject: Re: Cannot connect to SharePoint 2010 instance Yes, this can be somewhat tricky. There are a lot of potential configurations that could affect this. First, you want to verify that your IIS is using NTLM authentication, and that all the web services directories are executable. This is critical. Second, the credentials, in the form of domain\user, may be sensitive to whether you use a fully-qualified domain name or a shortcut domain name, e.g. mydomain.novartis.com or just mydomain. I suggest you try some combinations. The other thing you
Re: Cannot connect to SharePoint 2010 instance
If you want, we can create a ticket to cover SharePoint 2013 work. If you want to attempt a sanity check, if you email me (personally, to daddy...@gmail.com) the Microsoft.SharePoint.dll I can set up a ManifoldCF-Sharepoint-2013 plugin. If I can build that, then the next step would be just trying it all out and seeing where it fails. Karl On Tue, Nov 6, 2012 at 3:49 PM, Iannetti, Robert robert.ianne...@novartis.com wrote: Karl, That sounds reasonable. I am having my SP Admin set up the NTML SharePoint instance described below I will let you know how it works. BTW SP 2013 RTM has been released so we can cross #1 off the list :) Thanks Bob -Original Message- From: Karl Wright [mailto:daddy...@gmail.com] Sent: Tuesday, November 06, 2012 3:47 PM To: user@manifoldcf.apache.org Subject: Re: Cannot connect to SharePoint 2010 instance Hi Bob, That depends very strongly on whether SharePoint 2013 continues the Microsoft tradition of breaking web services that used to work. :-) Seriously, we need three things to develop a SharePoint 2013 solution: (1) A stable release (a beta is not sufficient because Microsoft is famous for changing things in a major way between beta and release); (2) a benevolent client with sufficient patience to try things out that we develop in their environment, and (3) enough time so that we're not on the bleeding edge and that other people have run into most of the sticky problems first. We're volunteers here and we all have day jobs, so we mostly can't afford to be pounding away at brick walls on our own. It could be the case that everything just works, in which case the development is trivial. We'll have to see. Karl On Tue, Nov 6, 2012 at 3:37 PM, Iannetti, Robert robert.ianne...@novartis.com wrote: Karl, On another topic is there a roadmap for supporting SharePoint 2013 ? We are in the process of migrating and were wondering when your ManifoldCF product would be available to support it. Thanks Bob -Original Message- From: Karl Wright [mailto:daddy...@gmail.com] Sent: Tuesday, November 06, 2012 3:34 PM To: user@manifoldcf.apache.org Subject: Re: Cannot connect to SharePoint 2010 instance Hi Bob, The only products I know have a similar limitations. The only one I know is the SharePoint google appliance connector, which when I looked last had exactly the same restriction. It also has other limitations, some severe, such as limiting the number of documents you can crawl to no more than 5000 per library. We are willing to do a reasonable amount of work to upgrade ManifoldCF to be able to support Kerberos. Here's a link which describes the situation: http://old.nabble.com/Support-for-Kerberos-SPNEGO-td14564857.html We currently use a significantly-patched version of 3.1, which supplied the NTLM implementation for 4.0 that is currently in use. Our issue is similar to the commons-httpclient team's, which is we have no good way of testing all of this, and none of us are security protocol experts. If you have (or know somebody with) such expertise, who would be willing/able to donate their time, this problem could be tackled I think without too much pain. So at least httpclient, given the right tickets, would be able to connect. The other issue with Kerberos auth is that I believe it will require a significant amount of work to allow anything using it to obtain the tickets from the AD domain controller. This would obviously require UI work for all connectors that would support Kerberos. But that is something I am willing to attempt if everything else is in place. Karl On Tue, Nov 6, 2012 at 3:11 PM, Iannetti, Robert robert.ianne...@novartis.com wrote: Karl, If this is not possible can you recommend any other products to crawl SharePoint content and index it in Solr? Thanks Bob -Original Message- From: Karl Wright [mailto:daddy...@gmail.com] Sent: Tuesday, November 06, 2012 3:10 PM To: user@manifoldcf.apache.org Subject: Re: Cannot connect to SharePoint 2010 instance No, Kerberos is not supported. This is a limitation of the Apache commons-httpclient library that we use for communicating with SharePoint. It is possible to set up IIS to serve a different port with different authentication that goes to the same SharePoint instance but is NTLM protected, not Kerberos protected. Perhaps you can do this and limit access to that port to only the ManifoldCF machine. Karl On Tue, Nov 6, 2012 at 3:03 PM, Iannetti, Robert robert.ianne...@novartis.com wrote: Karl, Our SharePoint sites use Kerberos authentication is this supported in ManifoldCF? Thanks Bob -Original Message- From: Karl Wright [mailto:daddy...@gmail.com] Sent: Tuesday, November 06, 2012 2:50 PM To: user@manifoldcf.apache.org Subject: Re: Cannot connect to SharePoint 2010 instance Yes, this can be somewhat tricky. There are a lot
RE: Cannot connect to SharePoint 2010 instance
Karl, Let try to get the 2010 connection working first before we proceed to the 2013. Thanks Bob -Original Message- From: Karl Wright [mailto:daddy...@gmail.com] Sent: Tuesday, November 06, 2012 3:59 PM To: user@manifoldcf.apache.org Subject: Re: Cannot connect to SharePoint 2010 instance If you want, we can create a ticket to cover SharePoint 2013 work. If you want to attempt a sanity check, if you email me (personally, to daddy...@gmail.com) the Microsoft.SharePoint.dll I can set up a ManifoldCF-Sharepoint-2013 plugin. If I can build that, then the next step would be just trying it all out and seeing where it fails. Karl On Tue, Nov 6, 2012 at 3:49 PM, Iannetti, Robert robert.ianne...@novartis.com wrote: Karl, That sounds reasonable. I am having my SP Admin set up the NTML SharePoint instance described below I will let you know how it works. BTW SP 2013 RTM has been released so we can cross #1 off the list :) Thanks Bob -Original Message- From: Karl Wright [mailto:daddy...@gmail.com] Sent: Tuesday, November 06, 2012 3:47 PM To: user@manifoldcf.apache.org Subject: Re: Cannot connect to SharePoint 2010 instance Hi Bob, That depends very strongly on whether SharePoint 2013 continues the Microsoft tradition of breaking web services that used to work. :-) Seriously, we need three things to develop a SharePoint 2013 solution: (1) A stable release (a beta is not sufficient because Microsoft is famous for changing things in a major way between beta and release); (2) a benevolent client with sufficient patience to try things out that we develop in their environment, and (3) enough time so that we're not on the bleeding edge and that other people have run into most of the sticky problems first. We're volunteers here and we all have day jobs, so we mostly can't afford to be pounding away at brick walls on our own. It could be the case that everything just works, in which case the development is trivial. We'll have to see. Karl On Tue, Nov 6, 2012 at 3:37 PM, Iannetti, Robert robert.ianne...@novartis.com wrote: Karl, On another topic is there a roadmap for supporting SharePoint 2013 ? We are in the process of migrating and were wondering when your ManifoldCF product would be available to support it. Thanks Bob -Original Message- From: Karl Wright [mailto:daddy...@gmail.com] Sent: Tuesday, November 06, 2012 3:34 PM To: user@manifoldcf.apache.org Subject: Re: Cannot connect to SharePoint 2010 instance Hi Bob, The only products I know have a similar limitations. The only one I know is the SharePoint google appliance connector, which when I looked last had exactly the same restriction. It also has other limitations, some severe, such as limiting the number of documents you can crawl to no more than 5000 per library. We are willing to do a reasonable amount of work to upgrade ManifoldCF to be able to support Kerberos. Here's a link which describes the situation: http://old.nabble.com/Support-for-Kerberos-SPNEGO-td14564857.html We currently use a significantly-patched version of 3.1, which supplied the NTLM implementation for 4.0 that is currently in use. Our issue is similar to the commons-httpclient team's, which is we have no good way of testing all of this, and none of us are security protocol experts. If you have (or know somebody with) such expertise, who would be willing/able to donate their time, this problem could be tackled I think without too much pain. So at least httpclient, given the right tickets, would be able to connect. The other issue with Kerberos auth is that I believe it will require a significant amount of work to allow anything using it to obtain the tickets from the AD domain controller. This would obviously require UI work for all connectors that would support Kerberos. But that is something I am willing to attempt if everything else is in place. Karl On Tue, Nov 6, 2012 at 3:11 PM, Iannetti, Robert robert.ianne...@novartis.com wrote: Karl, If this is not possible can you recommend any other products to crawl SharePoint content and index it in Solr? Thanks Bob -Original Message- From: Karl Wright [mailto:daddy...@gmail.com] Sent: Tuesday, November 06, 2012 3:10 PM To: user@manifoldcf.apache.org Subject: Re: Cannot connect to SharePoint 2010 instance No, Kerberos is not supported. This is a limitation of the Apache commons-httpclient library that we use for communicating with SharePoint. It is possible to set up IIS to serve a different port with different authentication that goes to the same SharePoint instance but is NTLM protected, not Kerberos protected. Perhaps you can do this and limit access to that port to only the ManifoldCF machine. Karl On Tue, Nov 6, 2012 at 3:03 PM, Iannetti, Robert robert.ianne...@novartis.com wrote: Karl, Our SharePoint sites use Kerberos authentication
