0

On a SharePoint 2013 OnPremise environment, we experience a problem that's been going on for a few months without us being able to find a resolution.

For some users, who have the following permissions granted :

  • Read access to root site
  • Limited access only, on a subsite "X" (user(s) must not have access to the other content of the subsite)
  • Limited access only, on a library "Y" located on subsite X (same as before, users must not have access to any other document of the library)
  • Collaboration and/or Modification on a file "Z" located directly in library Y (both permissions were tried separately and simultaneously, with no apparent changes)

The user has access to a link which is pointing at the /AllItems.aspx form of the library. This leads us to the following problem :

When the file is clicked, the user's computer tries to open it with Excel (2013). Then, an Authentication window pops up, and when the user enters his credentials and submits, this window comes right back. At this point, the file may be readable, but the user needs to modify it ! And by clicking the button inside the yellow ribbon to enter Edit mode, he triggers another credentials popup.

If we push along and keep submitting the (fine) credentials, eventually a new window comes in, just to say "A problem occured while connecting to the server. If it persists, contact the assistance.". And that's it.

We tried to have a closer look on the communications between Excel and SharePoint, so we used a Fiddler to do so. What we observe is an alternating of 401 (Unauthorized) and 200 (OK) responses from the server. Here's one raw sample of each (actually there's like a dozen of these received):

HTTP/1.1 401 Unauthorized
Server: Microsoft-IIS/8.0
WWW-Authenticate: NTLM TlRMTVNTUAACAA[...]A==
SPRequestGuid: f950559e-b894-c09f-c572-cb5ce481bab7
request-id: f950559e-b894-c09f-c572-cb5ce481bab7
X-FRAME-OPTIONS: SAMEORIGIN
SPRequestDuration: 1
SPIisLatency: 0
X-Powered-By: ASP.NET
MicrosoftSharePointTeamServices: 15.0.0.4569
X-Content-Type-Options: nosniff
X-MS-InvokeApp: 1; RequireReadOnly
Date: Tue, 20 Mar 2018 10:09:38 GMT
Content-Length: 0
Proxy-Support: Session-Based-Authentication

Then : 

HTTP/1.1 200 OK
Cache-Control: private
Transfer-Encoding: chunked
Content-Type: multipart/related; type="application/xop+xml";start="<http://tempuri.org/0>";boundary="uuid:9a81e2dd-1560-4d9d-a056-2294288c919c+id=54";start-info="text/xml"
Server: Microsoft-IIS/8.0
X-SharePointHealthScore: 0
MIME-Version: 1.0
X-AspNet-Version: 4.0.30319
SPRequestGuid: f950559e-0895-c09f-c572-cc1e0972a3a3
request-id: f950559e-0895-c09f-c572-cc1e0972a3a3
X-FRAME-OPTIONS: SAMEORIGIN
Persistent-Auth: true
X-Powered-By: ASP.NET
MicrosoftSharePointTeamServices: 15.0.0.4569
X-Content-Type-Options: nosniff
X-MS-InvokeApp: 1; RequireReadOnly
Date: Tue, 20 Mar 2018 10:09:38 GMT

1a3

--uuid:9a81e2dd-1560-4d9d-a056-2294288c919c+id=54
Content-ID: <http://tempuri.org/0>
Content-Transfer-Encoding: 8bit
Content-Type: application/xop+xml;charset=utf-8;type="text/xml"

<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><ResponseVersion Version="2" MinorVersion="2" ErrorCode="FileUnauthorizedAccess" xmlns="http://schemas.microsoft.com/sharepoint/soap/"/></s:Body></s:Envelope>
37

--uuid:9a81e2dd-1560-4d9d-a056-2294288c919c+id=54--

We are double-sure that the user does have the right to access this file, so why is there this ErrorCode=FileUnauthorizedAccess, in the "OK" response ? Anyone encountered this already, or have seen this somewhere ? I didn't manage to find exactly the same problem resolved on the web...

Thanks

|improve this question
  • 2
    check the site collection feature (Limited-access user permission lockdown mode ) if it is enabled , disable it and see if this solves your issue – A.Saéed Mar 21 '18 at 15:55
  • The 401-200 pattern is normal as first you request then receive 401 that you need to authenticate and then you get 200 after auth credentials are sent. – Marek Sarad Mar 22 '18 at 9:24
  • @Marek Ok thanks, good to know that this is to be expected. But is it normal that it occurs like, 6 times in a row? It's like ping-pong ; 401-200-401-200-401-200-401-200, and that seems weird to me ^^' Every time the user enters his credentials again, the popup comes back, and ultimately, it's an error message that pops out and simply says "meh, cannot open that file bro..." (don't remember the exact message x) ). It may be normal too, as there is an error sent back by the server. But why? The user has access to the file, and the library (limited access, for this one). – Hanayoru May 31 '18 at 16:26
  • Also, @A.Saéed, thank you for your reply, the feature was already deactivated, sadly. We did try to enable/disable it again but, no results. – Hanayoru May 31 '18 at 16:26
  • Re 401-200-401 that is not expected pattern. After you authenticate once you shouldn't have to do it second time. What version of office your users are using? Back in SP2007 days and XP I had this nagging issue with some users that had issues with opening files in word/excel it took me few months to figure out but it boiled down to wrong versions of the WebDAV dlls (even when OS was saying that they are on same update) replacing WebDAV dlls solved the issue for me. (but in my case they couldn't even open in read mode) – Marek Sarad Jun 14 '18 at 9:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.