locked
Import status "Waiting" forever due to error "The request failed with HTTP status 401: Unauthorized" in CrmAsyncService logs RRS feed

  • Question

  • Hi guys,

    I have read quite a few topics dealing with issues similar to the one I'm having, however none of the solutions worked for me... Here are a couple of things I tried:
    http://support.microsoft.com/kb/950416
    http://social.microsoft.com/Forums/en-US/crm/thread/443eda5d-b5b4-4cee-99d3-5170b9882b49
    http://blog.customereffective.com/blog/2009/06/troubleshooting-crm-authentication-on-windows-server-2008.html
    http://social.microsoft.com/Forums/en-US/crmdeployment/thread/ccf10f23-989f-4a86-8849-648c6affe4bd
    http://social.microsoft.com/Forums/en-US/crm/thread/05115db0-12e3-45c8-8f64-b80efc3d2ed2
    http://ronaldlemmen.blogspot.com/2009/04/401-unauthorized-when-accessing.html
    ...

    My CRM server is running Windows 2008 Server SP2 and I installed CRM 4.0 with update rollup 6 on it from scratch (no update from CRM 3.0). It's using a SQL 2008 Server.
    Below is the error I get in the CrmAsyncService log file.
    You will notice that the Organization ID is 000.. and so is the User ID, which makes me bend towards an impersonation issue (trying to use the MSCRM web service as an anonymous user), but I can't find out what setting I could have missed.

    Any thoughts?



    [2009-10-06 19:07:02.9] Process:CrmAsyncService |Organization:00000000-0000-0000-0000-000000000000 |Thread:   19(MSCRM:-TimerProcessor.ExecuteTimers) |Category: Platform.Sql |User: 00000000-0000-0000-0000-000000000000 |Level: Info | CrmDbConnection.ExecuteNonQuery
    at CrmDbConnection.ExecuteNonQuery(IDbCommand command, Boolean impersonate)
    at DataAccessSharedBase.ExecuteSqlCommand(IDbCommand command, Nullable`1 expectedAffectedRecords)
    at QueueDataAccess.UpdateStateAndStatusInternal(Guid eventId, Int32 newState, Int32 newStatus, DateTime nextOccurrence, Boolean retryOperation, Int32 currentRetryCount, Int32 errorCode, String errorMessage, Boolean clearData, Boolean removeEvent, Int32 operationType)
    at UpdateStateAndStatusCommand.InternalExecute()
    at QueuedDatabaseCommand.Execute(QueueManager queueManager)
    at QueueManager.ExecuteAllOutstandingDatabaseOperations()
    at QueueManager.OnDatabaseOperationTimerEvent(Object sender, ElapsedEventArgs e)
    at TimerProcessor.ExecuteTimers(Object data)
    at ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state)
    at ThreadHelper.ThreadStart(Object obj)
    >update AsyncOperationBase
    set
    StateCode = 1
    , StatusCode = 10
    , ErrorCode = -2147204346
    , Message = 'System.Net.WebException: The request failed with HTTP status 401: Unauthorized.
    at System.Web.Services.Protocols.SoapHttpClientProtocol.ReadResponse(SoapClientMessage message, WebResponse response, Stream responseStream, Boolean asyncCall)
    at System.Web.Services.Protocols.SoapHttpClientProtocol.Invoke(String methodName, Object[] parameters)
    at Microsoft.Crm.SdkTypeProxy.CrmService.Execute(Request Request)
    at Microsoft.Crm.Asynchronous.SdkTypeProxyCrmServiceWrapper.Execute(Object request)
    at Microsoft.Crm.Asynchronous.UserSettingsCacheLoader.RetrieveUserSettings(ICrmService crmService, Guid userId)
    at Microsoft.Crm.Asynchronous.UserSettingsCacheLoader.LoadCacheData(Guid userId, IOrganizationContext context)
    at Microsoft.Crm.Caching.BasicCrmCache`2.CreateEntry(TKey key, IOrganizationContext context)
    at Microsoft.Crm.Caching.BasicCrmCache`2.LookupEntry(TKey key, IOrganizationContext context)
    at Microsoft.Crm.Asynchronous.ImportOperation.GetUserLanguage(AsyncEvent asyncEvent)
    at Microsoft.Crm.Asynchronous.ImportOperation.InternalExecute(AsyncEvent asyncEvent)
    at Microsoft.Crm.Asynchronous.AsyncOperationCommand.Execute(AsyncEvent asyncEvent)
    at Microsoft.Crm.Asynchronous.QueueManager.PoolHandler.ProcessAsyncEvent(AsyncEvent asyncEvent)'
    , PostponeUntil = '12/30/9999 23:59:59'
    , ModifiedOn = DATEADD(MILLISECOND, -1*DATEPART(MILLISECOND, GETUTCDATE()), GETUTCDATE())
    , ModifiedBy = CreatedBy
    where AsyncOperationId = '2f0cfbcc-98b2-de11-92e2-005056b8747c'


    • Edited by Thibault B. _ Wednesday, October 7, 2009 8:22 AM Fixing the links
    Wednesday, October 7, 2009 8:21 AM

Answers

  • It seems like you have tried all of the 'standard' fixes yet something in your environment is not working as expected.  This type of scenario is generally one where Microsoft Support can step in and more effectively identify the exact issue.  I suggest opening a ticket with them.  Let us know the fix once you have it.  Thank you
    Best Regards, Donna
    Wednesday, October 14, 2009 12:46 PM
  • Hi Thibault,

    Yes - reinstalling everything is probably the best next action.

    FYI - regarding installing CRM using precreated groups.  I did test this in a lab environment and had issues.  In the end I convinced the client to isntall crm with an elevated security account and did not need to pre-crease groups, but my guess is that a step is possible missing when groups are pre-created???

    Good luck with the reinstall if you go that route.
    Alex Fagundes - www.PowerObjects.com
    Wednesday, October 14, 2009 1:51 PM

All replies

  • Hi,

    A couple more things to try:
      -If crm is on a dedicated box, make sure http://localhost:port works from the server itself.
      -Try to run crm async service as local host
      -Did you change the port that crm web site is listening on after installing?  if so, there is also a registry key to change in software/microsoft/mscrm
    Alex Fagundes - www.PowerObjects.com
    Wednesday, October 7, 2009 4:12 PM
  • Hi Alex, thanks for your reply

    - The CRM is on a dedicated box, http://localhost:80 works fine from the server even when I log in with the service account (AD account) used by the Asynchronous Processing Service
    - I tried basically the three available options: Local System account, Network Service and a domain account, it doesn't solve this issue
    - I added the support for HTTPS but I didn't make it mandatory, I have already tested changing the port to 443 and I get the same result.

    Thursday, October 8, 2009 7:24 AM
  • For information: when I allow anonymous user authentication on MSCRMServices directory in IIS it works fine, however it is obviously not acceptable to use this setting for more than a few minutes.
    Thursday, October 8, 2009 10:24 AM
  • Hi,

    I don't know the exact topology of your deployment: this could be a problem with SPNs (but again I don't know how you have set up the deployment), plese review this post http://blogs.msdn.com/crm/archive/2009/08/06/configuring-service-principal-names.aspx

    When have you set the identity of the async service to a domain user?
    • Marked as answer by Jim Glass Jr Thursday, October 8, 2009 3:14 PM
    • Unmarked as answer by Thibault B. _ Thursday, October 8, 2009 7:52 PM
    Thursday, October 8, 2009 10:34 AM
  • Thanks for your reply ckeller, unfortunately I already went through this article and I *should* have everything set properly.
    The Asynchronous Processing Service is running as crm_srvc (AD user), and this user is trusted for delegation and has the following SPN associated with it (in addition to HOST):
    HTTP/crm.mydomain.tld
    HTTP/crmserver
    HTTP/crmserver.mydomain.tld
    HTTPS/crm.mydomain.tld
    HTTPS/crmserver
    HTTPS/crmserver.mydomain.tld

    This account is also the one used for the CRM AppPool and belongs to the PrivUserGroup and SQLAccessGroup. It also has an account in the CRM.

    My IIS Web Site does not have any host header specified.
    Thursday, October 8, 2009 7:52 PM
  • Hi Thibault,

    So no workflows run at all?
    And you checked this KB  http://support.microsoft.com/kb/950416 ??


    Alex Fagundes - www.PowerObjects.com
    Thursday, October 8, 2009 10:18 PM
  • Hi Alex,
    Exactly, workflows don't run either. Basically everything relying on this Async Service doesn't work.
    I also went through this article before, with no luck :s
    Friday, October 9, 2009 7:31 AM
  • Hi Thibault,

    Very odd.  I've seen this issue close to a dozen times in various crm systems, and always one of the items mentioned above has fixed it. 

    Besides recomending to re-verify all items above, and rebooting ;-), not sure what else to recommend.   Do you have all the latest and greatest patches, including all the dot net framework updates?


    Alex Fagundes - www.PowerObjects.com
    Tuesday, October 13, 2009 5:35 PM
  • I already have tried a reboot but it didn't change anything, also I have CRM Rollup Update 6 installed which I believe is the latest one. The server also has .NET Framework 3.5 SP1 installed and is fully up to date.

    I didn't mention it, but I installed the CRM using pre-created Active Directory security groups, are there any issues that can arise from that? Here is the article I used: http://support.microsoft.com/kb/946677
    Before this setup I had run a standard setup and since the group organization in AD wasn't what I wanted it to be I uninstalled it and proceeded to a new custom install: I assumed the uninstalling process was cleaning up everything, but it might actually not be the case, what do you think?

    I think my next move will be to reinstall everything from scratch (DB + CRM Server) if I don't find any solution...

    Thanks!
    Wednesday, October 14, 2009 7:32 AM
  • Hi Thibault , what do you get if you do http://server_ip and not http://localhost

    SJ
    Wednesday, October 14, 2009 12:28 PM
  • Hi Sean,
    Using the CRM IP address I get the same result: the CRM works mostly fine and I still can't import.
    Wednesday, October 14, 2009 12:42 PM
  • It seems like you have tried all of the 'standard' fixes yet something in your environment is not working as expected.  This type of scenario is generally one where Microsoft Support can step in and more effectively identify the exact issue.  I suggest opening a ticket with them.  Let us know the fix once you have it.  Thank you
    Best Regards, Donna
    Wednesday, October 14, 2009 12:46 PM
  • Hi Thibault,

    Yes - reinstalling everything is probably the best next action.

    FYI - regarding installing CRM using precreated groups.  I did test this in a lab environment and had issues.  In the end I convinced the client to isntall crm with an elevated security account and did not need to pre-crease groups, but my guess is that a step is possible missing when groups are pre-created???

    Good luck with the reinstall if you go that route.
    Alex Fagundes - www.PowerObjects.com
    Wednesday, October 14, 2009 1:51 PM