0

We have a webapp http://intranet01 (default zone) with an internal zone AAM http://intranet and a public zone http://intranet.company.com. Everyting works fine except one solution.

The solution contains a web part which lists all user profile images and names. It works for some users, but not for others. When it doesn't work, the user is requested to log in over and over again (for as many times as there are images on the page). The server is returning a 401 (access denied) for each image.

On the page where the web part is deployed, the images are referenced to as http://intranet01/my/profile/.../image.png. If I copy this link and open it in the browser, I can see the profile picture in question. However, if I try to access http://intranet.company.com/my/profile/.../image.png in the browser, I get an access denied and can't see the image.

As mentioned, the images are referenced as http://intranet01/my/profile/.../image.png. In a test env. the same images are referenced as /my/profile/.../image.png (i.e. server relative). Why the images aren't referenced server relative on the env. in question is beyond me.

It doesn't matter if I browse the site with intranet01, intranet or intranet.company.com - I still get access denied on the page in question.

It should not be an issue with the page or the user, as the page is published and I myself am a site collection admin and still get access denied, while others whom are normal users can access the page (and images - and yes, they can see the images). It seems like this is not consistent though, as normal users also can get an access denied.

We use claims based authentication. We have uploaded all the images using PowerShell, and run the command Update-SPProfilePhotoStore after completion (with the mysitelocation url parameter of intranet.company.com).

Edit to add: If I access the intranet with http://intranet01 I only get access denied two times because two of the images are linking to http://intranet.company.com/my/..., while the others are linking to http://intranet01/my/... And if I access with intranet.company.com, the two same images are working, while all the others are not.

Improve this question
1
  • If I access the intranet with intranet01 I only get access denied two times because two of the images are linking to intranet.company.com/my..., while the others are linking to intranet01/my... And if I access with intranet.company.com, the two same images are working, while all the others are not.
    – tarjeieo
    Commented Jul 25, 2011 at 13:46

2 Answers 2

Reset to default
0

This is usually a browser setting issue.

Your browser needs to have both Intranet URL (eg. http://intranet) and My Site host url (eg. http://my.intranet) to intranet zone.

You can also opt for Trusted Zone, but then you also need to specify "Automatic logon with current user name and password" in Custom Level > User Authentication

These settings can be rolled out as a Group Policy to all your users browsers

Improve this answer
5
  • I tried to add all the urls to intranet sites in IE, but the problem persists.
    – tarjeieo
    Commented Jul 25, 2011 at 13:52
  • check that this image.png is fully published and that all users has access to read it
    – Anders Rask
    Commented Jul 25, 2011 at 14:00
  • All the images are in the /my site collection's picture library. Is it even possible to unpublish/publish from there?
    – tarjeieo
    Commented Jul 25, 2011 at 14:14
  • hmmm checked ULS log?
    – Anders Rask
    Commented Jul 25, 2011 at 14:17
  • Yeah, nothing noteworthy. The requests are the same for the images that are returned and the images that are denied, except for the url (which is either intranet.company.com or intranet01)
    – tarjeieo
    Commented Jul 25, 2011 at 14:26
0

This issue was resolved by a colleague. The steps to resolve this was to

  1. Change the user profile app to point to http://intranet.company.com instead of http://intranet01.
  2. Change the default AAM zone to http://intranet.company.com (intranet AAM zone is still http://intranet and added a custom AAM zone as http://intranet01)
  3. Made a script that changed the url of all user profile pictures to http://intranet.company.com/my/... instead of http://intranet01/my/...
Improve this answer
1
  • This wasn't a very good solution either. Turns out now you can't browse with intranet - will ask for credentials x # of times.
    – tarjeieo
    Commented Aug 2, 2011 at 13:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.