On a SharePoint 2013 OnPremise environment, we experience a problem that's been going on for a few months without us being able to find a resolution.
For some users, who have the following permissions granted :
- Read access to root site
- Limited access only, on a subsite "X" (user(s) must not have access to the other content of the subsite)
- Limited access only, on a library "Y" located on subsite X (same as before, users must not have access to any other document of the library)
- Collaboration and/or Modification on a file "Z" located directly in library Y (both permissions were tried separately and simultaneously, with no apparent changes)
The user has access to a link which is pointing at the
/AllItems.aspx form of the library. This leads us to the following problem :
When the file is clicked, the user's computer tries to open it with Excel (2013). Then, an Authentication window pops up, and when the user enters his credentials and submits, this window comes right back. At this point, the file may be readable, but the user needs to modify it ! And by clicking the button inside the yellow ribbon to enter Edit mode, he triggers another credentials popup.
If we push along and keep submitting the (fine) credentials, eventually a new window comes in, just to say "A problem occured while connecting to the server. If it persists, contact the assistance.". And that's it.
We tried to have a closer look on the communications between Excel and SharePoint, so we used a Fiddler to do so. What we observe is an alternating of 401 (Unauthorized) and 200 (OK) responses from the server. Here's one raw sample of each (actually there's like a dozen of these received):
HTTP/1.1 401 Unauthorized Server: Microsoft-IIS/8.0 WWW-Authenticate: NTLM TlRMTVNTUAACAA[...]A== SPRequestGuid: f950559e-b894-c09f-c572-cb5ce481bab7 request-id: f950559e-b894-c09f-c572-cb5ce481bab7 X-FRAME-OPTIONS: SAMEORIGIN SPRequestDuration: 1 SPIisLatency: 0 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 22.214.171.12469 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly Date: Tue, 20 Mar 2018 10:09:38 GMT Content-Length: 0 Proxy-Support: Session-Based-Authentication
HTTP/1.1 200 OK Cache-Control: private Transfer-Encoding: chunked Content-Type: multipart/related; type="application/xop+xml";start="<http://tempuri.org/0>";boundary="uuid:9a81e2dd-1560-4d9d-a056-2294288c919c+id=54";start-info="text/xml" Server: Microsoft-IIS/8.0 X-SharePointHealthScore: 0 MIME-Version: 1.0 X-AspNet-Version: 4.0.30319 SPRequestGuid: f950559e-0895-c09f-c572-cc1e0972a3a3 request-id: f950559e-0895-c09f-c572-cc1e0972a3a3 X-FRAME-OPTIONS: SAMEORIGIN Persistent-Auth: true X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 126.96.36.19969 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly Date: Tue, 20 Mar 2018 10:09:38 GMT 1a3 --uuid:9a81e2dd-1560-4d9d-a056-2294288c919c+id=54 Content-ID: <http://tempuri.org/0> Content-Transfer-Encoding: 8bit Content-Type: application/xop+xml;charset=utf-8;type="text/xml" <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><ResponseVersion Version="2" MinorVersion="2" ErrorCode="FileUnauthorizedAccess" xmlns="http://schemas.microsoft.com/sharepoint/soap/"/></s:Body></s:Envelope> 37 --uuid:9a81e2dd-1560-4d9d-a056-2294288c919c+id=54--
We are double-sure that the user does have the right to access this file, so why is there this
ErrorCode=FileUnauthorizedAccess, in the "OK" response ? Anyone encountered this already, or have seen this somewhere ? I didn't manage to find exactly the same problem resolved on the web...