0

I am trying to run SharePoint 2013 workflow on SharePoint 2016 farm but it is not working. I am logged in as SharePoint Setup account (the one which installed SharePoint) and it is a local admin. I can publish workflows fine but workflow remain in "Activity in progress". It's internal status is "Started". Here's the error I receive:

Retrying last request. Next attempt scheduled after 8/1/2019 12:50. Details of last request: HTTP Unauthorized to http://mysharepoint/_api/web/lists(guid'c31057f3-1a73-4354-bd5b-e41433ec3695') Correlation Id: 062f0b82-8ac1-d3c8-90a3-523d9f67c7e0

In ULS logs I am getting following error:

An exception occurred when trying to issue security token: UserProfileApplicationNotAvailableException_Logging :: UserProfileApplicationProxy.GetRawPartitionID has null proxy.

When I try to access workflow manager site in browser http://localhost:12291/ then I get following error:

<Code>AuthorizationError</Code>

<Message>The caller does not have the necessary permissions required for this operation. Permissions granted: None. Required permissions: ReadScope.</Message>

Everything appears to be working fine such as:

In CA Workflow Service Application Proxy says Workflow is connected. Both App Management Service and Subscription Settings Service service applications are started.

App Management Service, Claims to Windows Token Service and Microsoft SharePoint Foundation Subscription Settings Service services on the server are started. Even User Profile Service is started although no service application has been configured because I don't need it.

I can browse Security Token service in browser. http://mysharepoint:32843/SecurityTokenServiceApplication/securitytoken.svc

I even tried PowerShell mentioned on following page and it is issuing me tokens just fine.

https://blogs.technet.microsoft.com/spjr/2018/06/18/sharepoint-troubleshooting-the-security-token-service-sts/

Also tried following commands: 

$sec = New-Object Microsoft.Workflow.Client.Security.WindowsSecurityConfiguration("All Users")
$sec.WorkflowAdminGroupName = "Users"
Set-WFScopeSecurity -ScopeUri http://mysharepoint:12291/ -SecurityConfiguration $sec

In IIS under SecurityTokenServiceApplicationPool I have set Load User Profile to True

As you can see I have tried everything I can but still same issue. I turned on verbose logging and here are some results from ULS:

Token Cache:  Successfully wrote token XML.  
Using windows integrated auth.  
SPFederationAuthenticationModule.IsRedirectToLogOnPage: This is a 302 redirect to /_login/default.aspx?ReturnUrl=%2f_api%2fweb%2flists(guid%27c31057f3-1a73-4354-bd5b-e41433ec3695%27)  
SPFederationAuthenticationModule.OnEndRequest: User was being redirected to authenticate.  
Claims Windows Sign-In: Sending 401 for request 'http://mysharepoint/_api/web/lists(guid'c31057f3-1a73-4354-bd5b-e41433ec3695')' because the user is not authenticated and resource requires authentication.  
SPOAuthHttpChallenge: Setting WWW-Authenticate header to:Bearer realm="167929ff-bd38-46c3-b82c-e0da00fc0f7e",client_id="00000003-0000-0ff1-ce00-000000000000",trusted_issuers="00000005-0000-0000-c000-000000000000@*,00000003-0000-0ff1-ce00-000000000000@167929ff-bd38-46c3-b82c-e0da00fc0f7e"  
SPSuspendedFeaturesHttpHeader: Setting x-ms-suspended-features header to:features=""

Do I really need to configure User Profile Service application for this work? I don't think it is necessary right!?

How to fix this issue?

Improve this question
2
  • I went into Site Settings --> Manage Site Features and activated Workflows can use app permissions which fixed the issue but now I am facing another one. Now System Account can run workflows and for all other users I am getting same error which I posted above.
    – Frank Martin
    Aug 1, 2019 at 11:56
  • Hi, yes it looks like you need to have UPS.
    – Zdeněk Vinduška
    Aug 1, 2019 at 13:03

2 Answers 2

Reset to default
1

Short answer is YES, you need to UPS to be running and the user triggering the Work Flow has to have a profile in the UPS.

https://sharepointv15.wordpress.com/2013/08/07/install-and-configure-workflow-for-sharepoint-2013/

Improve this answer
1
  • Yeah, it looks like that is the case. But strangely workflow runs when the item is added by System Account and for all other users, it is not working.
    – Frank Martin
    Aug 2, 2019 at 9:36
0

No, User profile doesn't need to be configured. This is a known issue and i have faced it before.

Follow the below mentioned steps to solve this.

On the server where the workflow manager has been installed.

  1. $configuration = New-Object Microsoft.Workflow.Client.Security.WindowsSecurityConfiguration("All Users")
  2. $configuration.WorkflowAdminGroupName = "Users"
  3. Set-WFScopeSecurity -ScopeUri https://:12290/ -SecurityConfiguration $configuration

On the SharePoint server

  1. Register-SPWorkflowService –SPSite "https:///" –WorkflowHostUri "https://:12290/" –AllowOAuthHttp –Force

Follow the steps above and let me know if this does not solve your issue.

Improve this answer
2
  • I have already done these steps but no luck.
    – Frank Martin
    Aug 2, 2019 at 9:32
  • I read on the verbose logging part that the user is not authenticated and the action requires authentication. If that is the thing , you may need to provision User profile . Also you can check the User Information List. Check if your user is present in the UIL . If already present remove and add him again . The problem may be due to the fact that the workflow is not able to catch your user because of a corrupted profile in UIL.
    – Yash Kamdar
    Aug 4, 2019 at 6:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.