I'm trying to set-up Access Services in SharePoint 2013, in a multi-tenant environment. I've followed Anne's guide
With the following adjustments:
- I did not set-up a new
SQLinstance just for Access, I am using the current
- I did not start Access Services 2010 as I believe it is an optional step and it is for backward capability.
- I did not create an empty web application as I'm not sure if that is necessary in a HNSC environment.
The issue is when I go and create an Access App, it would error. And in the details page:
"There was a problem accessing the app's database. Details: Access is denied to the Secure Store Service."
Upon looking up the correlation ID, the error is:
Exception while executing task e55e0fbc-bce5-4f3a-ae66-27d118607639 of type Microsoft.SharePoint.Packaging.SPDatabaseDeploymentGroup in job 17bbb974-f59e-4001-ad7d-598f09748dee for instance 5155ff9a-08a0-43c9-80a8-ec0845c62fb7 sitesubscription 39d493f9-4883-4f89-a120-6c4d28a534a0, rollback = False: Microsoft.Office.SecureStoreService.Server.SecureStoreServiceException: Access is denied to the Secure Store Service. at Microsoft.SharePoint.Utilities.SecureStoreHelper.ExecuteSecureStoreMethod(String methodName, Object args) at Microsoft.SharePoint.Utilities.SecureStoreHelper.EnsureTargetApplication(ITargetApplicationDefinition targetApplication, IList
1 targetApplicationFields, IList1 adminClaims, IList`1 groupClaims, Boolean addSystemClaim, Boolean& created) at Microsoft.SharePoint.Packaging.SPAppDeploymentUtility.WriteConnectionStringPartsToSecureStore(String targetApplicationId, Guid appInstanceId, SPSite site, NetworkCredential dboCredential, NetworkCredential loginCredential, String groupAccount) at Microsoft.SharePoint.Packaging.SPDatabaseDeploymentGroup.CreateTargetAppAndStoreCredentials(String dbConnStringSsoApplicationId, NetworkCredential dboCredential, NetworkCredential loginCredential, String groupAccount) at Microsoft.SharePoint.Packaging.SPDatabaseDeploymentGroup.DeployInternal(Stream dacFileStream, Stream dataPopulationScriptStream) at Microsoft.SharePoint.Packaging.SPDatabaseDeploymentGroup.Deploy() at Microsoft.SharePoint.Administration.SPAppTask.DeployOperation() at Microsoft.SharePoint.Lifecycle.MonitoredTaskExecution.DoTask()
So it looks like it is having issue creating the target application.
I've given the service account for the Access Services, and also the web application full control on the Secure Store, both the Administrator and the Permissions section. I've also explicitly given them dbo access to the Secure Store database and also the dbcreator and securityadmin server roles.
Secure Store itself works fine with no issue.
I'm wondering if it has anything to do with multi-tenancy setup, where target applications are setup at the tenant level, but Access Services is trying to create it at the farm level?