SharePoint does not support UPN format as app pool account

Symptoms

When you configure the identity of your application pool for the web application hosting SSP admin site collection to be different from the farm account, and you use UPN format when you enter the user name, this may break some pages in the SSP search administration page, i.e. when you open the search administration page, you may receive the following error under Status: 

Could not connect to server <server name> for application 'SharedServices1'. This error might occur if the server is not responding to client requests, the firewall or proxy configuration is preventing the server from being contacted, or the search administration Web service is not running on the server.

Cause

This issue occurs because UPN format is not fully supported. When you update identity of app pool backing the web application of SSP admin site (i.e. through Central Administration -> Operations -> Service Accounts -> select Web application pool -> select the app pool for web application hosting SSP admin site -> type in account and password), SharePoint will automatically grant the account permission through defining an <authorization> rule in web.config for the Shared Service. The content looks like the following. The format of <allow> may be abc@example.com, or example\abc depending on how you enter the username in theService Accounts page. abc@example.com will not work because the section of definition is parsed by System.Web.Security.UrlAuthorizationModule which does not fully support UPN format username.


C:\Program Files\Microsoft Office Servers\12.0\WebServices\Root\web.config

    <location path="SharedServices1"  inheritInChildApplications="true">
        <microsoft.office.server>
            <sharedServices providerId="a65c192a-c70b-4718-9d88-c29e44373f93" />
        </microsoft.office.server>
        <system.web>
            <authorization>
                <allow users="abc@example.com" />
            </authorization>
        </system.web>
    </location>

Resolution

In the Service Accounts page when you enter an account for an application pool, please use the domain\user format instead of UPN (abc@example.com).
속성

문서 ID: 2374065 - 마지막 검토: 2010. 8. 23. - 수정: 1

피드백