Unique permissions on file : cannot open in Excel

Question

On a SharePoint 2013 OnPremise environment, we experience a problem that's been going on for a few months without us being able to find a resolution.

For some users, who have the following permissions granted :

• Read access to root site
• Limited access only, on a subsite "X" (user(s) must not have access to the other content of the subsite)
• Limited access only, on a library "Y" located on subsite X (same as before, users must not have access to any other document of the library)
• Collaboration and/or Modification on a file "Z" located directly in library Y (both permissions were tried separately and simultaneously, with no apparent changes)

The user has access to a link which is pointing at the /AllItems.aspx form of the library. This leads us to the following problem :

When the file is clicked, the user's computer tries to open it with Excel (2013). Then, an Authentication window pops up, and when the user enters his credentials and submits, this window comes right back. At this point, the file may be readable, but the user needs to modify it ! And by clicking the button inside the yellow ribbon to enter Edit mode, he triggers another credentials popup.

If we push along and keep submitting the (fine) credentials, eventually a new window comes in, just to say "A problem occured while connecting to the server. If it persists, contact the assistance.". And that's it.

We tried to have a closer look on the communications between Excel and SharePoint, so we used a Fiddler to do so. What we observe is an alternating of 401 (Unauthorized) and 200 (OK) responses from the server. Here's one raw sample of each (actually there's like a dozen of these received):

HTTP/1.1 401 Unauthorized
Server: Microsoft-IIS/8.0
WWW-Authenticate: NTLM TlRMTVNTUAACAA[...]A==
SPRequestGuid: f950559e-b894-c09f-c572-cb5ce481bab7
request-id: f950559e-b894-c09f-c572-cb5ce481bab7
X-FRAME-OPTIONS: SAMEORIGIN
SPRequestDuration: 1
SPIisLatency: 0
X-Powered-By: ASP.NET
MicrosoftSharePointTeamServices: 15.0.0.4569
X-Content-Type-Options: nosniff
X-MS-InvokeApp: 1; RequireReadOnly
Date: Tue, 20 Mar 2018 10:09:38 GMT
Content-Length: 0
Proxy-Support: Session-Based-Authentication

Then :

HTTP/1.1 200 OK
Cache-Control: private
Transfer-Encoding: chunked
Content-Type: multipart/related; type="application/xop+xml";start="<http://tempuri.org/0>";boundary="uuid:9a81e2dd-1560-4d9d-a056-2294288c919c+id=54";start-info="text/xml"
Server: Microsoft-IIS/8.0
X-SharePointHealthScore: 0
MIME-Version: 1.0
X-AspNet-Version: 4.0.30319
SPRequestGuid: f950559e-0895-c09f-c572-cc1e0972a3a3
request-id: f950559e-0895-c09f-c572-cc1e0972a3a3
X-FRAME-OPTIONS: SAMEORIGIN
Persistent-Auth: true
X-Powered-By: ASP.NET
MicrosoftSharePointTeamServices: 15.0.0.4569
X-Content-Type-Options: nosniff
X-MS-InvokeApp: 1; RequireReadOnly
Date: Tue, 20 Mar 2018 10:09:38 GMT

1a3

--uuid:9a81e2dd-1560-4d9d-a056-2294288c919c+id=54
Content-ID: <http://tempuri.org/0>
Content-Transfer-Encoding: 8bit
Content-Type: application/xop+xml;charset=utf-8;type="text/xml"

<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><ResponseVersion Version="2" MinorVersion="2" ErrorCode="FileUnauthorizedAccess" xmlns="http://schemas.microsoft.com/sharepoint/soap/"/></s:Body></s:Envelope>
37

--uuid:9a81e2dd-1560-4d9d-a056-2294288c919c+id=54--

We are double-sure that the user does have the right to access this file, so why is there this ErrorCode=FileUnauthorizedAccess, in the "OK" response ? Anyone encountered this already, or have seen this somewhere ? I didn't manage to find exactly the same problem resolved on the web...

Thanks