3

We have a service account Domain/accountname that moves items from a file share to SharePoint 2013 library. As of Thursday, this account is getting Access Denied on the server.

Looking at the ULS logs for the library, we are receiving an Authentication error "Non-OAuth request. IsAuthenticated=False, UserIdentityName=, ClaimsCount=0" over and over again.

  1. All users other than this user can access
  2. Verified user is using claims based authentication
  3. NTLM is listed as the Windows Authentication Provider
  4. Application Pool "SharePoint Web Services Root" is stopped
  5. Active Directory account is enabled, not locked or suspended
  6. AppFabric Caching Service is started (Automatic and Running)
  7. Verified user has access to contribute to library

Here is our Security Token Configuration

SecurityTokenServicePublicUrlSuffix         : /_vti_bin/spsecuritytokenserviceactive.svc
SecurityTokenServiceMetadataPublicUrlSuffix : /_vti_bin/spsecuritytokenserviceactive.svc/mex
LocalLoginProvider                          : SPLocalLoginProvider Name=SharePoint
TrustedLoginProviderNames                   : {}
TrustedLoginProviders                       : {}
TrustedAccessProviders                      : {}
TrustedSecurityTokenServices                : {}
AuthenticationPipelineClaimMappingRules     : {WindowsMappingRule}
AllowMetadataOverHttp                       : False
UseSessionCookies                           : False
WindowsTokenLifetime                        : 00:02:00
FormsTokenLifetime                          : 00:02:00
CookieLifetime                              : 5.00:00:00
ServiceTokenLifetime                        : 10:00:00
MaxLogonTokenCacheItems                     : 250
MaxLogonTokenOptimisticCacheItems           : 100000
LogonTokenCacheExpirationWindow             : 00:01:00
MaxServiceTokenCacheItems                   : 250
MaxServiceTokenOptimisticCacheItems         : 100000
ServiceTokenCacheExpirationWindow           : 00:10:00
ApplicationTokenLifetime                    : 1.12:00:00
AuthenticatorTokenLifetime                  : 1.12:00:00
MinApplicationTokenCacheItems               : 250
MaxApplicationTokenCacheItems               : 100000
ApplicationTokenCacheExpirationWindow       : 00:10:00
LoopbackTokenLifetime                       : 10:00:00
AllowOAuthOverHttp                          : True
CookieValueHandlerType                      : Microsoft.SharePoint.IdentityModel.SPSessionSecurityTokenCookieValue
NameIdentifier                              : 00000003-0000-0ff1-ce00-000000000000@f3838494-46f8-4fca-b50e-5441b0b64079
PidEnabled                                  : True
HybridStsSelectionEnabled                   : True
UseIncomingUriToValidateAudience            : False
DeleteInvalidCookies                        : False
WindowsModeIgnoreCache                      : False
Name                                        : SecurityTokenServiceManager
TypeName                                    : Microsoft.SharePoint.Administration.Claims.SPSecurityTokenServiceManager
DisplayName                                 : SecurityTokenServiceManager
Id                                          : 8a1dc780-6cfe-484d-a87f-b6d82d822713
Status                                      : Online
Parent                                      : SPSecurityTokenService Name=SecurityTokenService
Version                                     : 1183711
Properties                                  : {}
Farm                                        : SPFarm Name=SP_Config
UpgradedPersistedProperties                 : {}
CanSelectForBackup                          : True
DiskSizeRequired                            : 0
CanSelectForRestore                         : True
CanRenameOnRestore                          : False


**IIS Logs**


2017-07-31 00:02:00 10.2.1.149 OPTIONS /HIM/HIM_TEAM/ROI/CN_FAX - 443 - 10.2.37.254 Microsoft-WebDAV-MiniRedir/6.2.9200 - 401 0 0 3
2017-07-31 00:02:00 10.2.1.149 OPTIONS /HIM/HIM_TEAM/ROI/CN_FAX - 443 - 10.2.37.254 Microsoft-WebDAV-MiniRedir/6.2.9200 - 401 0 0 3
2017-07-31 00:02:00 10.2.1.149 OPTIONS /HIM/HIM_TEAM/ROI/CN_FAX - 443 - 10.2.37.254 Microsoft-WebDAV-MiniRedir/6.2.9200 - 401 0 0 3
2017-07-31 00:02:00 10.2.1.149 OPTIONS /HIM/HIM_TEAM/ROI/CN_FAX - 443 - 10.2.37.254 Microsoft-WebDAV-MiniRedir/6.2.9200 - 401 0 0 3
2017-07-31 00:02:05 10.2.1.149 OPTIONS /HIM/HIM_TEAM/ROI/CN_FAX/0046C7A7.PDF - 443 - 10.2.37.254 Microsoft-WebDAV-MiniRedir/6.2.9200 - 401 0 0 3
2017-07-31 00:02:05 10.2.1.149 OPTIONS /HIM/HIM_TEAM/ROI/CN_FAX/0046C7A7.PDF - 443 - 10.2.37.254 Microsoft-WebDAV-MiniRedir/6.2.9200 - 401 0 0 4
2017-07-31 00:02:05 10.2.1.149 OPTIONS /HIM/HIM_TEAM/ROI/CN_FAX/0046C7A7.PDF - 443 - 10.2.37.254 Microsoft-WebDAV-MiniRedir/6.2.9200 - 401 0 0 2
  • There's not enough info here to help. Can you please gather IIS logs with the 401 (or possibly 403) error? Are you able to log on interactively and browse the site with this account to test it (potentially including a Fiddler trace)? – Trevor Seward Aug 1 '17 at 18:43
  • Could you please provide the ULS-Log of that action. – MHeld Aug 3 '17 at 8:17
1

With the given information, it might be possible that the "Claims to Windows Token Service" has been stopped.

Please check if it is started in CentralAdministration -> System Settings -> Manage services on server

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.