0

I'm having trouble getting Cloud Hybrid Search configured with my SharePoint 2013 on-prem farm and I think our Single Sign On is the culprit. Has anyone had success with setting up Cloud Hybrid Search in a SSO environment?

I've tried both the Hybrid Configuration Wizard, and PowerShell approaches outlined in the Configure Cloud Hybrid Search Roadmap, but both end with authentication errors even though the wizard confirms the farm and tenant credentials have sufficient privileges.

In the wizard, the Failure Report returns the following exception: "PowerShell failed to invoke configure script: Authentication Error: Bad username or password." The following line in the full log references our SSO URL:

FINISH Time=6750.2ms Results=System.Management.Automation.RuntimeException: Authentication Error: Bad username or password. ---> System.Exception: Authentication Error: Bad username or password. ---> Microsoft.IdentityModel.Clients.ActiveDirectory.AdalServiceException: Federated service at https://x.x.com/SecureAuth15/webservice/wstrust.svc/2005/usernamemixed returned error: At least one security token in the message could not be validated. ---> System.Net.WebException: The remote server returned an error: (500) Internal Server Error.

When running the Onboard-CloudHybridSearch.ps1 PowerShell script, after the output "Connecting to O365..." the exception returned is, "Authentication Error: Unexpected authentication failure".

Provisioning the Search Service Application seems to work fine with both approaches, but I can't get past the on-boarding step in either.

I've also tried adding our tenant and tenant admin URLs to Trusted Sites in Internet Options, running the setup while logged into the SharePoint server as the tenant admin account and farm admin account, making the tenant admin account a farm admin, etc.

Thanks for any help!

Improve this question

1 Answer 1

Reset to default
0

I'm unsure which part of 'SSO' you're referring to. Users in SharePoint must be using Windows Auth, not SAML/FBA in order to consume hybrid Search. If you have MFA or anything on your Global Admin account that is running the Onboarding script, it needs to be disabled or use a cloud-only Global Admin account.

Improve this answer
1
  • Thanks Trevor, the cloud-only account was the answer I needed. The Hybrid Picker wizard still appeared to fail with the same error, but the Onboarding script finally completed. Cloud Hybrid Search is working well now!
    – Jason
    Commented Jun 18, 2018 at 18:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.