GP 2016 Web Client user can login but errors are showing up in SQL error log

(0) Share

Report

Posted on by Community Member

I've got a curious issue with our new GP 2016 install. We have a mix of web client users and local client users, but this only appears to effect the web client users. While they don't appear to have any issues logging into the system, I am seeing one of these error showing up in the SQL error log (per company) depending on whether or not they are setup as "Web Client Only" or not:

Login failed for user 'DOMAIN/Network Login Name'. Reason: Could not find a login matching the name provided. (Web Client Only)

Login failed for user 'SQL Login Name'. Reason: Password did not match that for the login provided. (non-Web Client Only)

I'm just not sure what is causing these errors to generate since the users are able to access the system - and why do I get the same error three times in a row (we have three companies so I'm guessing that is why)?

Anyone else seeing this and have a fix?

Thanks,

-pat

Version GP 2016R2 16.00.062

*This post is locked for comments

I have the same question (0)

All responses (33)

Answers (0)

Community Member on at

Like (0)

Report

So, is the problem that no one else is experiencing/able to replicate this or no one has an answer?

Was this reply helpful? Yes No
Beat Bucher GP Gee... 28,058 Moderator on at

Like (0)

Report

Pat,

Are you able to identify a single login related to the error message on the SQL server... ? or is it based on the end-user trying to login into the web client..

Normally, the process should be setup to require from the end-user only the Network userID & Pwd, and GP should pass the SQL credentials based on the User setup in GP to the SQL server.. (2nd tab of the User setup in GP, enter a corresponding AD user account)

Was this reply helpful? Yes No
Community Member on at

Like (0)

Report

Are you able to identify a single login related to the error message on the SQL server... ? or is it based on the end-user trying to login into the web client..

The errors are showing the users' credentials that are logging in via the web client - regardless if they are setup as web client only or if they have their AD account associated with their SQL login account. Just different error messages as above. No abnormal errors are being generated from logging in through the standard fat client (local login).

Normally, the process should be setup to require from the end-user only the Network userID & Pwd, and GP should pass the SQL credentials based on the User setup in GP to the SQL server.. (2nd tab of the User setup in GP, enter a corresponding AD user account)

I have users setup correctly as far as I can tell. For Web Client Only, only the AD account is available to setup. For both Web Client and fat client, both the AD account is setup and the SQL login is setup.

Was this reply helpful? Yes No
Community Member on at

Like (0)

Report

I still have no answer as to why these login errors are occurring. I've seen one other post with a similar issue (login errors in sql but is user is still able to access GP). Does anyone have good documentation on how GP authenticates an AD user? Maybe I can track it from that angle.

Was this reply helpful? Yes No
Beat Bucher GP Gee... 28,058 Moderator on at

Like (0)

Report

Hi Pat,

I've checked my SQL log today as I just logged into the 2016R2 Web client interface, but there is absolutely no entries.. Did you validated that your GPWebClient account in the GP Utilities has the proper security setup ? or maybe it's only affecting regular users (I'm part of the 'sysadmin' role on my SQL server)..

Was this reply helpful? Yes No
Community Member on at

Like (0)

Report

The GPWebClient SQL account has DYNGRP access to all company and DYNAMICS dbs. The web client AD service account has access to the GPConfiguration database only with db_datareader, db_datawriter, GP Service, GP Session Central, GPWMC and public role membership.

Does anything appear to be missing? Could his be due to something screwy with a certificate maybe?

Was this reply helpful? Yes No
Beat Bucher GP Gee... 28,058 Moderator on at

Like (0)

Report

Trying to login with a different domain user.. may have triggered a certificate error on the server side, though I'm not 100% sure it's related to the login..

There was a message like " Automatic certificate enrollment for DOMAIN\user failed (0x8007052e) The user name ore password is incorrect..

Which I now is not true, as I was able to validate that credential against another instance.. strangely enough the report user name in the windows log was not the one I used to login thru the web client.

but I'd need to dig further into this ..

Was this reply helpful? Yes No
Derek Albaugh on at

Like (1)

Report

If you're seeing errors like this:

Login failed for user 'DOMAIN/Network Login Name'. Reason: Could not find a login matching the name provided. (Web Client Only)

It would seem something isn't setup correctly for Identity Management (single sign on) to work for Web Client.

There's only 3 parts of Identity Management setup:

1. In GP Utilities, setup a proxy account which will be created as a SQL login and given DYNGRP for all GP databases, system and company.

2. When installing Web Client, in the 'GP Configuration' window, enter this same proxy account and password credentials.

3. In the User Setup window, you can create Web Client Only users and tie them to their Windows AD accounts.

Once this is done correctly, after logging into the initial Web Client logon window, the user should be automatically logged into Dynamics GP with their associated GP login/user id.

If you're seeing a Dynamics GP login window show, then something isn't setup correctly for one of the 3 steps mentioned above.

**Make sure your proxy account doesn't have a password more than 15 characters, because that is the limit and it will cut off anything longer than that.**

In Event Viewer, if you're seeing 'State: 5', that indicates an invalid user id, and 'State: 8' indicates a password mismatch.

Also, make sure to enter the proxy account credentials using correct upper and lower case characters, because SQL Server is case-sensitive and a proxy account of WCProxy is different than WcProxy, even though they are spelled the same way.

My thinking is to setup a new proxy account and run Repair on Web Client entering this same new proxy in the 'GP Configuration' window and see if that resolves the issue.

Thank you,

Was this reply helpful? Yes No
Community Member on at

Like (0)

Report

Thanks for the step-by-step. I'll try it once again just to make sure the account was entered correctly. Someone else ran the setup the last few times, so I guess it's time for me to do it myself this time. Good reminder on the password length, but it does fall between 8 and 15 characters. I guess the question I have is this: if the proxy is not entered correctly - how is it that people are still able to access the application?

Was this reply helpful? Yes No
Derek Albaugh on at

Like (1)

Report

Without the proxy account, users that have a valid SQL login (i.e. not Web Client Only users) would still be able to login to Web Client and Dynamics GP, but the issue will be with Web Client Only users, as they will be prompted with the GP login window and as they don't actually have a SQL login, they can't enter anything there.

Was this reply helpful? Yes No