SharePoint does not support UPN format as app pool account

When you configure the identity of your application pool for the web application hosting SSP admin site collection to be different from the farm account, and you use UPN format when you enter the user name, this may break some pages in the SSP search administration page, i.e. when you open the search administration page, you may receive the following error under Status: 

Could not connect to server <server name> for application 'SharedServices1'. This error might occur if the server is not responding to client requests, the firewall or proxy configuration is preventing the server from being contacted, or the search administration Web service is not running on the server.

This issue occurs because UPN format is not fully supported. When you update identity of app pool backing the web application of SSP admin site (i.e. through Central Administration -> Operations -> Service Accounts -> select Web application pool -> select the app pool for web application hosting SSP admin site -> type in account and password), SharePoint will automatically grant the account permission through defining an <authorization> rule in web.config for the Shared Service. The content looks like the following. The format of <allow> may be abc@example.com (mailto:abc@example.com) , or example\abc depending on how you enter the username in theService Accounts page. abc@example.com (mailto:abc@example.com) will not work because the section of definition is parsed by System.Web.Security.UrlAuthorizationModule which does not fully support UPN format username.


C:\Program Files\Microsoft Office Servers\12.0\WebServices\Root\web.config

    <location path="SharedServices1"  inheritInChildApplications="true">
        <microsoft.office.server>
            <sharedServices providerId="a65c192a-c70b-4718-9d88-c29e44373f93" />
        </microsoft.office.server>
        <system.web>
            <authorization>
                <allow users="abc@example.com (mailto:abc@example.com) " />
            </authorization>
        </system.web>
    </location>

In the Service Accounts page when you enter an account for an application pool, please use the domain\user format instead of UPN (abc@example.com (mailto:abc@example.com) ).

Note This is a "FAST PUBLISH" article created directly from within the Microsoft support organization. The information contained herein is provided as-is in response to emerging issues. As a result of the speed in making it available, the materials may include typographical errors and may be revised at any time without notice. See Terms of Use (http://go.microsoft.com/fwlink/?LinkId=151500) for other considerations.