asked on June 29, 2020
Hi,
I'm trying to set up the accelerator to fetch my OLAP data with "Windows Authentication".
I'm able to fetch data using Chrome, but when trying with Firefox I get an error instantly after giving my credentials.
The response of the request:
{"sessionId":0.0,"data":null,"error":{"message":"The connection either timed out or was lost."}}
The error from flemonster-proxy-ssas.exe:
ERROR The connection either timed out or was lost.
at Microsoft.AnalysisServices.AdomdClient.XmlaClient.EndRequest(Boolean useBinaryXml)
at Microsoft.AnalysisServices.AdomdClient.XmlaClient.SendMessage(Boolean endReceivalIfException, Boolean readSession, Boolean readNamespaceCompatibility)
at Microsoft.AnalysisServices.AdomdClient.XmlaClient.Discover(String requestType, String requestNamespace, ListDictionary properties, IDictionary restrictions, Boolean sendNamespacesCompatibility, IDictionary requestProperties)
at Microsoft.AnalysisServices.AdomdClient.XmlaClient.SupportsProperty(String propName)
at Microsoft.AnalysisServices.AdomdClient.XmlaClient.Connect(ConnectionInfo connectionInfo, Boolean beginSession)
at Microsoft.AnalysisServices.AdomdClient.AdomdConnection.XmlaClientProvider.Connect(Boolean toIXMLA)
at Microsoft.AnalysisServices.AdomdClient.AdomdConnection.XmlaClientProvider.Microsoft.AnalysisServices.AdomdClient.AdomdConnection.IXmlaClientProviderEx.ConnectXmla()
at Microsoft.AnalysisServices.AdomdClient.AdomdConnection.ConnectToXMLA(Boolean createSession, Boolean isHTTP)
at Microsoft.AnalysisServices.AdomdClient.AdomdConnection.Open()
at Flexmonster.Accelerator.Controllers.FlexmonsterProxyController.OpenConnection(AdomdConnection connection, BaseArgs args)
at Flexmonster.Accelerator.Controllers.FlexmonsterProxyController.GetSessionId(BaseArgs args)
at Flexmonster.Accelerator.Controllers.FlexmonsterProxyController.DiscoverDimensions(DiscoverArgs args)
When connecting through Chrome I don't have to give my credentials manually, but I do when using Firefox.
// Richard
⋅ July 2, 2020
This also happens on Microsoft Edge 44.17763.1.0 (Microsoft EdgeHTML 18.17763)
⋅ July 2, 2020
Hi Richard,
Thank you for posting your question.
We've done some tests on our side and didn't manage to reproduce the described behavior so far.
More specifically, we've used our guide to set up Windows Authentication for Flexmonster Accelerator and tested it on the latest Chrome 83, Edge 83 & Firefox 78.0.1. We would suggest following the steps described in the mentioned guide when setting up authentication on your side to ensure everything is configured correctly.
In case this does not help, we would appreciate it if you could provide more details on your situation with exact steps on how to reproduce the issue.
Also, addressing your last point regarding the sign-in popup not appearing it Chrome, this happens when you're loading the page from a non-incognito window while already being signed in to your Windows account.
We would be happy to hear your feedback!
Looking forward to hearing from you.
Kind regards,
Mykhailo
⋅ July 2, 2020
Hi, I just played around with the settings and the problem seems to stem from the connection string.
I'm connecting directly to the server with the SSAS Cube, ie "Data Source=serverName". This worked fine with Chrome and IE11 when using the es5.js version.
But when i changed it to my msmdpump version, ie "Data Source=http:localhost/OLAP/msmdpump.dll" it works on Firefox and Edge. We would prefer not to use the msmdpump work-around and connect directly to the server.
Are you able to reproduce the bug in that way?
If not, I will try to gather all relevant information and provide it. (btw, I followed your guide on windows auth, so it should be the same)
Regards,
Richard
⋅ July 3, 2020
Hi Richard,
Thank you for your fast response.
So far, it is not entirely clear to us why this approach results in different outcomes depending on the browser – perhaps the mentioned browsers process the authorization/authentication differently.
Do you think it would be possible for you to provide us with a link to your Accelerator with some kind of test user credentials so that we can do some debugging on our side?
Looking forward to your reply.
Regards,
Mykhailo
⋅ July 6, 2020
Hi Mykhailo,
I sadly cannot provide you with a link as we are running on an internal net with no internet connection, but I will see if I can host something on my internet machine and replicate the bug. You are not able to replicate it on your end? All I've done is hosting the cube on a different server, then connecting to it using the server name as Data Source.
Regards,
Richard
⋅ July 7, 2020
Hi Richard,
We've didn't encounter the mentioned issues when hosting the cube on a different server as well.
Would that be possible for you to send us the logs of your browser's console so that we can see what kind of errors it returns?
Thank you in advance!
Kind regards,
Mykhailo
⋅ July 7, 2020
The only log i get is the one i showed in the first post. It gives me a 200 OK but that the connection timed out.
These are the differences when looking at the logs in dev tools + accelerator: https://imgur.com/a/j1QOUfJ
⋅ July 8, 2020
Hi Richard,
Thank you for sending over the requested screenshots.
We are currently investigating this further and it would also be helpful if you could provide us with the following info as well:
Please let us know if that would be possible.
Looking forward to your reply!
Kind regards,
Mykhailo
⋅ July 9, 2020
⋅ July 10, 2020
Hi Richard,
Thank you for sending over the requested information once again.
After additional testing, we still aren't able to reproduce exactly what you've reported.
As a potential workaround, have you considered keeping the cube and the Accelerator on the same server? One of our suspicions is that in your case the authorization is probably compromised somewhere during the transfer from the Accelerator to the server, which can be fixed by simply hosting them on the same machine. This way is also somewhat easier to configure and returns the data faster.
Please let us know what you think.
Regards,
Mykhailo
⋅ July 22, 2020
Hi Richard,
We were wondering if there is any progress with this issue on your side. Have you managed to find a solution, or is it still pending?
We would be happy to hear your thoughts.
Regards,
Mykhailo
⋅ July 23, 2020
Hi Mykhailo,
I've not been able to fix it yet no as it hasn't been my main priority at the moment.
I need to test on a different set up of servers first to see that the problem is simply not on my computer, but I will not be able to place it on the same server as the cube as it is not on our server.
Regards,
Richard Davy
⋅ July 23, 2020
Hi Richard,
Thank you for the heads-up – let us keep in touch in case you have any updates or further questions on this.
Have a great day!
Kind regards,
Mykhailo
⋅ July 27, 2020
Hi again, I've now noticed that the issue stems from windows authentication. I moved the Flexmonster Accelerator to another server and now I get the same issue with Chrome as I described in the first post.
I tried looking at the analysis services logs, they are hard to get any information out of, but I saw some of my requests were with 'locale = 1053' (swedish language in windows) and some in 'locale = 1033' (US).
I've had problems with this in the past, connecting to the cube with any other locale than 1033 doesn't work, so it might be because of this (Firefox makes the request with locale 1053 and chrome with 1033 for some reason) but I can't say for sure. Have you had any problems related to this?
However, on the bright side I did notice that it was possible to connect through Firefox when turning off the windows authentication.
Regards,
Richard
⋅ July 29, 2020
Hi Richard,
Up until this point, we've never really encountered the issue with different locale values in practice – unfortunately, there is not much we can suggest in this situation.
Still, feel free to share your further updates on this in case you manage to resolve this problem – it would be great to have a potential solution for similar cases in the future.
Regards,
Mykhailo
⋅ August 4, 2020
Hi again Mykhailo,
I've done some more checks and I don't think its the locale anymore, but rather it the windows authentication in general.
When I check the logs on the Analysis Service I can see that:
Can this be related to Kerberos Double Hoping?
⋅ August 6, 2020
Richard,
The mentioned user behavior you've discovered through the logs is, in fact, expected.
More specifically, if Windows Authorization is enabled, the client-side takes the credentials of the user from the client machine and sends it over to the Accelerator. The received credentials are then compared to the ones available on the Accelerator's machine – since the Accelerator & Analysis Services are often hosted on the same server, they naturally share the same user base and authorization issues rarely emerge here.
With that in mind, if the issue is actually related to the Kerberos Double Hop, it seems to us that putting the Accelerator and Analysis Services on the same machine would be the easiest solution – this would ensure that the users are shared between them and no authorization issues should emerge.
Alternatively, you might try manually configuring your Accelerator & Analysis Services machines to share the users, if this is achievable in your situation.
We hope this helps.
Kind regards,
Mykhailo
