Ok so I've like been nearly a month on this and I'm still no further on so would like some help please. I setup a new farm consisting of 3 2012R2 servers (All VM's), A DC, an SQL 2014 Server and a SharePoint 2013 enterprise server.
I followed the guide here https://technet.microsoft.com/en-us/library/dn659286.aspx with the exception that I bought a cert and used https: throughout the script where necessary and for the most part things work fine. i.e I can add tenants and users, the users can upload docs, perform, inline editing and install most apps from the store (Note: I didn't create an isolated app domain, I simply used the main domain name, unsafe I know but I figured I'd create one at a later stage). Don't get me wrong, this is probably a far from perfect install as I've never built a multi tenanted farm before, (in fact I've never even installed sharepoint on-premise in any guise before now)
so I fully expected some challenges here and there. I've read, but probably not fully understood, just about every article on the net related to my searches of "There was a problem accessing the app's database. Details: Access is denied to the Secure Store Service" and "Cannot find site lookup info for request Uri" and have learned tons of stuff about the inner workings of SharePoint. However nothing I've tried so far has led me to be able to add an access app. So... firstly I have a bunch of questions about how stuff is supposed to work, the answers to which, I'm hoping will lead to a better understanding and hopefully a solution.
Questions: I get the following error a few times in ULS when trying to add an access app through the site as a user whether internally or externally;
"Cannot find site lookup info for request Uri http://spserver:32843/988bae1c45a14c43bb355e036aee0de9/AccessService.svc"
What exactly is this trying to say? what is it trying to lookup? if I paste that url into a browser on a machine on the LAN I get the AccessServiceSOAP service page which I believe is the correct response. I'm guessing this soap service should not be available to the outside world and the requests are all handled internally? (as currently I only have port 443 mapped through the firewall)
The other question I have is regarding the Secure Store Service. I have it installed and up and running (as per script in article mentioned above) and I can create a target app via a tenant admin fine. However adding an Access App via a browser throws up the "There was a problem accessing the app's database. Details: Access is denied to the Secure Store Service" error. I'm wondering if that is a symptom of the above question about the uri lookup error. How can I test the SSS is configured correctly? are there other apps which use it or can I test some other way apart from adding an Access App?