Web Client: HTTP Error 500.0 - Internal Server Error

Web Client: HTTP Error 500.0 - Internal Server Error

Unknown   Februari 16, 2017   Comment  

Just recently I was assisting a partner on the Dynamics GP Partner forum with an error they were receiving when attempting to log into the Microsoft Dynamics GP web client.

Summary

The partner reported they could log into web client just fine from the SQL Server. However, when they launched web client from the Web Server that host the Dynamics GP web application, they received:

HTTP Error 500.0 - Internal Server Error

Now, this error is a pretty generic error. In addition to not being able to log in, the landing page would not display the Microsoft Dynamics GP logo.

Troubleshooting the Issue

The partner had tried the following troubleshooting techniques:

1. Repaired Microsoft Dynamics GP web components
2. Uninstalled and reinstalled web components
3. Rebooted the server

In addition, I recommended my article Microsoft Dynamics GP 2016 web client UI not displaying icons to ensure static content had been enabled during Internet Information Services (IIS) configuration. Typically, when static content is not enabled, the web client image resources do not get displayed.

Usually, after trying options 1 and 2, if you are still experiencing issues not allowing you to bypass the login window, you know you are facing a pre-requisite configuration issue.

Reading the Detailed Error Information section, you will notice that the error was caused by an authentication request, trying to access an image resource file using Anonymous Authentication by an Anonymous user. In simple terms, this is a permissions issue.

Upon inspecting the GP website authentication setting, the partner noticed the credentials for the anonymous user identity were set to IUSR.

So what's the big deal?

Anonymous authentication gives users access to the public areas of your website without prompting them for a user name or password. When a user attempts to connect to your public Web site, your Web server assigns the user to the Windows user account called IUSR.

By default, the IUSR account is included in the IIS_USRS built-in group. This group has security restrictions, imposed by NTFS permissions that designate the level of access and the type of content available to public users. With that said, websites such as the GP web belong in the private domain and most organizations disable anonymous authentication totally for the GP websites and revoke access to the IUSR account or IIS_USRS group to the website folder to prevent unauthorized access.

If you are running IIS 7.5 on Windows Server 2008 R2, or a later version of IIS, for every application pool you create, the Identity property of the new application pool is set to ApplicationPoolIdentity by default. The IIS Admin Process (WAS) will create a virtual account with the name of the new application pool and run the application pool's worker processes under this account by default.

By setting the ApplicationPoolIdentity as the anonymous user account for a site, you can isolate content and configuration for that site so that no other sites on the same IIS web server can access it, even if you have enabled anonymous authentication. GP web client installation allows you to specify a domain account as the identity for the Web Management Console and GP web application pools. The installer in turn will ensure the proper permissions are given to the folders hosting the web site and the GP web components.

This is particularly useful if you are a hosting provider running multiple customer websites on a single IIS server. Having the ability to control the website access and the content that is displayed is very important.

For a primer on IUSR vs application pool identity, take a look at the following article by Tristan K.

IUSR vs Application Pool Identity – Why use either?

The fix

In this particular case, switching the Anonymous Authentication credentials from IUSR to ApplicationPoolIdentity fixed the issue, although, keep in mind that the GP web client does not require anonymous authentication to be enabled.

Until next post!

MG.-
Mariano Gomez, MVP

Deploying Microsoft Dynamics GP Web Client with Office 365 Identity and Azure Active Directory - Part 1

Deploying Microsoft Dynamics GP Web Client with Office 365 Identity and Azure Active Directory - Part 1

Unknown   Januari 27, 2017   Comment  

Hi! As of late I have been seeing a number of questions on forums about deploying Microsoft Dynamics GP Web Client using Office 365 identity. So I figured I would take a deep dive look into this topic, by providing a bit of background and steps to achieve a successful deployment. What you need to know is, you have a range of options.

---

Background

Office 365 uses Azure Active Directory (Azure AD) cloud-based user authentication service to manage users. This service provides 3 identity models that can be used to manage user accounts:

Cloud identity. In this scenario, accounts are managed in Office 365 only. All the administration is done in the cloud, requiring no on-premise servers to manage the accounts.

Synchronized identity. In this particular case, your on-premise directory objects are synchronized with Office 365, with the bulk of the administration done from your on-premise server. Passwords can be synchronized such that users have the same password both on-premises and in the cloud. The downside to this approach is, users will need to sign in twice: once to the local domain and yet again to access Office 365.

Federated identity. This identity management model allows you to synchronize your on-premises directory objects with Office 365 and manage your users on-premises. The users have the same password on-premises and in the cloud, and they do not have to sign in again to use Office 365. This is often referred to as single sign-on.

The following video describes in more detail how each of these identity models work:



Most organizations will fall within the Synchronized or Federated model, but as more and more organizations move to a pure cloud model, cloud identities are becoming very common.

In my next article, I will go into the pre-requisites to deploy Microsoft Dynamics GP Web Client with Office 365.

Until next post!

MG.-
Mariano Gomez, MVP

Google Chrome Penalizes Websites Using SHA-1 SSL Certificates

Google Chrome Penalizes Websites Using SHA-1 SSL Certificates

Unknown   November 23, 2016   Comment  

Just recently, I was working with the Microsoft Dynamics GP 2016 web client and, as is customary, I run my tests on Google Chrome and Microsoft Internet Explorer and Edge browsers. When I brought up the web client website on Internet Explorer and Edge, nothing out of the ordinary seem to happen and effectively, the address bar is squeaky clean, as shown below:

Microsoft Edge address bar

Internet Explorer address bar

However, when you bring up the same site in Google Chrome, you are greeted with a site configuration warning and struck-out https prefix, as shown below

Chrome address bar

If you further click on the warning sign, you get additional information stating:

"This site uses a weak security configuration (SHA-1 signatures), so your connection may not be private."

The Details link is further more descriptive by opening the Chrome Security pane, where you get additional information stating the certificate expiration date is approaching soon and that the page is insecure.

So, I figured, an SSL certificate is an SSL certificate and SHA-1 is by far better than HTTP or no certificate at all (which is not supported by the web client). However, I started digging a bit more and, as it turned out, Google began phasing out support for SHA-1 certificates since version 42 of Chrome. The phase out has happened slowly. In version 42, users received a simple yellow warning triangle with a padlock to indicate the site used a weak SSL encryption, IF their certificate expired in 2016. If the certificate expires past 2016 -- like in the case of my certificate -- the user would receive a "broken https" indication.

However, at this point, it seems Google is not planning on blocking connection to sites with SHA-1 certificates, but this is not assurance that it won't happen. So what do you need to do? If you have third party certificates in place, you probably have already been contacted by your Certificate Authority company and they probably have issued you a SHA-256 certificate. If you are using Active Directory Certificate Store certificates, you can read up the Technet article on Implementing SHA-2 in Active Directory Certificate Services.

If you are using Self-Signed certificates, you may want to use these only in a development environment and forego their use in production.

If you are unsure of what type of encryption you are running, you can check your SLL certificates at:

Qualys SSL LABS

Note that the Qualys test can only be run on port 443.

Until next post!

MG.-
Mariano Gomez, MVP

Microsoft Dynamics GP 2016 web client UI not displaying icons

Microsoft Dynamics GP 2016 web client UI not displaying icons

Unknown   November 03, 2016   Comment  

Just today, I ran into a community forum post requesting an answer on why Microsoft Dynamics GP 2016 web client UI does not display icons. Since I had ran into this same issue before, I though I would I create this article to address the topic.

The Problem

Most users reporting this issue, experience things like the images shown below, where the Microsoft Dynamics GP logo and upper left corner application splash image are missing.

Microsoft Dynamics GP Sign In page (Sessions)

Furthermore, if you are able to access the application, mind you, sometimes this is not possible due to static content restrictions, you may find that your navigation bar and other areas of the application are missing the respective icons.

It is worth noting that in most cases, the missing icons do not negate the events of the buttons or objects they are associated with.

The theory

In web development, static content are files that don't change based on user input, and they consist of things like JavaScript, Cascading Style Sheets, Images, and HTML files. As you would expect, the Microsoft Dynamics GP web client icons and images fall within the category of static content. However, it is necessary to instruct the web server, in this case Internet Information Services (IIS), that it must publish any such content when identified.

Static Content is a feature that is turned on by default when IIS is deployed bare bones, this is, accepting all the default features - this is also known as deploying a static content IIS web server, which is the most basic of web servers.

The solution

Below, you will find instructions for Windows 10 and Windows Server 2012 and above.

Installing IIS Features on Windows 8 and Windows 10: Static Content

1. Right-click on Start and choose Program and Features

2. In the Windows Features window, locate and expand Internet Information Services.

3. Expand World Wide Web Services and Common HTTP Features.

4. Click on Static Content, to enable this feature.

5. Click the OK button. Windows 8 and Windows 10 will proceed to apply the selected changes. When finished, click the Close button to exit.

At this stage, a reboot may or may not be required. Follow any instructions provided after closing the window.

Installing IIS Features on Windows Server 2012 R2: Static Content

1. Open Server Manager by clicking the Server Manager icon on the task bar

2. In the Server Manager window, with the Dashboard and Quick Start selected, click Add roles and features, or click the Manage menu, and then click Add Roles and Features. The Add Roles and Features Wizard will start with a Before You Begin page. The wizard asks for verification of the following:

• The administrator account has a strong password. 
• The network settings, such as IP addresses, are configured. 
• The most current security updates from Windows® Update are installed.

3. On the Before You Begin page, click Next.
4. On the Installation Type page, select Role-based or feature-based installation to configure a single server. Click Next.

5. On the Server Selection page, select Select a server from the server pool, and then select a server.

6. On the Server Roles page, expand Web Server (IIS).

7. Click Next twice to bypass the Features page and the Web Server Role (IIS) page.

8. On the Role Services page, expand Web Server and Common HTTP Features. Click to enable Static Content.

9. After you have added the role services that you need on the Role Services page, click Next.

10. On the Confirmation page, verify the role services and features that are selected. Select Restart the destination server automatically if required to restart the destination server if the settings need to take immediate effect. To save the configuration information to an XML-based file that you can use for unattended installations with Windows PowerShell, select Export configuration settings, move to the appropriate path in the Save As dialog box, enter a file name, and then click Save.

When you are ready to start the installation process on the Confirmation page, click Install.

Until next post!

MG.-
Mariano Gomez, MVP

Microsoft reIMAGINE 2016 - Day 2

Microsoft reIMAGINE 2016 - Day 2

Unknown   Oktober 03, 2016   Comment  

Microsoft reIMAGINE 2016 hosted by Dynamic Communities is now over, but I did not want to let this week go by without giving you an account of my experiences at the conference, which sure brought a lot of surprises to all the partners in attendance.

---

Tuesday, September 20, 2016

Well Day 1, was certainly jammed packed with activities for David and I. Today however, was more of a transition day, where I would get to attend a few sessions, along with presenting one of my own.

I started out the day with Understanding Workflow and Document Attach, presented by Theresa Nistler, Senior Program Manager at Microsoft. Frankly, I neglected learning the initial versions of Workflow, but Dynamics GP 2016 certainly rocks and new and improved version of it, with easy configuration and a slick integration to the Document Attach feature, which I have implemented a few times. It was also good for me to attend this session, as I have a development project that involves integrating with Workflow, to improve some of our product capabilities here at Mekorma.

Following Theresa's session, it was time for me to go get setup to present my session, Dynamics GP Web Client Infrastructure and Troubleshooting. While I have presented web client sessions at previous conferences, as recent as Amplify, this session was totally new in its content and reach, as it was geared toward technical and consulting folks. My approach to this session was fundamentally exploring the web client architecture and infrastructure, all the while showcasing some of the tools I use to troubleshoot issues when installing and deploying the application.

Next off was some lunch with my coworkers, Lee Butenhoff and Jay Manley at Spitfire Bar &Grill, to discuss some of our most immediate project needs and deliverables. Having time with the guys in Fargo was awesome as we don't get to have these face to face exchanges that often, so to the tune of awesome ribs and fountain drinks, we went over all that we needed to accomplish after reIMAGINE.

Apparently, I had walked away from my session leaving my cell phone at the podium. Although the thought of losing once cellphone is always scary, I was pretty sure it would be delivered to the proper hands, so back at the Microsoft campus, I ran into Shanna Hensch from Dynamic Communities, who already was looking for me to turn over the phone back to me.

I made sure all was cool with my phone and to my surprise, I came across this fantastic selfie featuring the beautiful Tonya Anderson, Global Partner Engagement Manager at Dynamic Communities, who thought it would be fun to snap herself for posterity.

Tonya Anderson

At 2:45 PM, I decided to attend the session Custom Workflow Creation with Vince Guzik, Senior Software Engineer at Microsoft. Vince's presentation was a no nonsense display of how to rapidly create custom workflows with Dexterity, by using API functions created in the Dynamics GP dictionary for this purpose. A constant definition, a couple script procedure calls, and voila! A custom workflow! The real kicker is that existing Microsoft Dynamics GP workflows can be extended to include custom fields from other dictionaries, minimizing the need for from the ground up workflows.

Following the afternoon sessions, we had planned to have dinner among the Mekorma developers in attendance and go bar hopping in downtown Fargo, as part of the ISV sponsored Pub Crawl, so I went back to the hotel to change off and meet Jay and David downstairs to leave.

NOTE: Although David is not an official Mekorma employee, he works with us on special projects and we distribute his products worldwide, as part of the arrangements we have with Winthrop Development Consultants, so he's an integral part of the team.

Jay Manley, Lee Butenhoff, David Musgrave, and Mariano Gomez

Jay and Lee, being the locals, selected Rustica Eatery & Tavern in Moorhead, MN, just across the Red River from Fargo. Rustica is a great spot serving creative American fare in one room and artisan pizzas & beer in the other. The atmosphere in this place is upscale without being pretentious and the food is to die for.

On the way out to the pub crawl, David decided he needed to have a picture with Jay's Hummer H2, on the parking deck.

David Musgrave and Hummer H2

Our next stop would be downtown Fargo, just a few minutes from Rustica, where we had dinner. To note also, the keynote was taking place at the Fargo theater, but this year we decided not to attend in favor of the pub crawl. I have to admit that coming to Fargo at the beginning of Autumn is really fantastic. The weather couldn't be any better and the city is just a vibrant place.

Fargo Downtown

Fargo Theater

 Another view of the same street (Broadway N).

While the pub crawl would take us to several spots, our group decided to target Pickled Parrot sponsored by Njevity, Dempsey's Public House sponsored by Binary Stream, and Sazerac Alley sponsored by Greenshades Software. At the end of the evening, we decided to settle for Pickled Parrot - Big up to Njevity for throwing a really cool party!

Until next post!

MG.-
Mariano Gomez, MVP

GPUG Amplify Anaheim 2016 - Day 2

GPUG Amplify Anaheim 2016 - Day 2

Unknown   Juni 02, 2016   Comment  

Day 2 had me down for 2 sessions. Also, I was invited to participate in an interview with the first GP Live @ #GPUGAmplify live TV stream. My first session, Microsoft Dynamics GP Web Client Architecture, started at 9 AM.

Note: I couldn't get the session name to be changed as the schedule had already been printed by the time I requested the name change.

Web Client Focus  (picture courtesy of Microsoft MVP Steve Endow)

This session covered 4 main topics: web client described, web client architecture, web client infrastructure, and the benefits of the web client.  From an architecture and infrastructure perspective, we dove into how the different web client components interact between each other when a browser request is submitted to the web server until a web client runtime process is spun up on a session host.

Web Client Infrastructure

Understanding this interaction, required explaining in more detail how the Dynamics GP runtime engine and the web client runtime interacted to translate notifications and actions (messages) between the Window Manager components in each runtime.

Web Client Messaging

Finally, my session covered the benefits and scalability of the web client, when compared to RDP mechanisms like Citrix or Terminal Server.

Web Client Scalability (picture courtesy of Microsoft MVP Steve Endow)

Following my session, I went back to the Mekorma Hub to coordinate my live stream interview with Bob McAdam and his team. I was scheduled to go on at 3:30 PM, just after my afternoon session, which would be a repeat of the GP Administration session, completed the day before.

I decided then to go for lunch and had a chance to catch up with my good friend Linda Rose from RoseASP. Our conversation went from personal to business, to how we spend our time at work. Linda is always a very interesting person to converse with as she has so much knowledge about the Dynamics GP application hosting space, plus she has some awesome anecdotes to go along.

After lunch, I decided to go check out the room where I will be delivering my next presentation, and lo and behold there was Linda, ready to deliver her session, Upgrading to Dynamics GP 2016 in the Cloud: 3 simple steps. I decided to show my support and sat into the session, where I learned a few interesting things about cloud hosting and licensing.

Linda Rose and I after her session

Following Linda's session, I delivered my repeat session on Microsoft Dynamics GP Administration. Frankly, I was surprised once more to have a standing room only attendance. As is customary, I treated the group to a picture and a little stretching exercise to overcome post lunch time food coma.

Microsoft Dynamics GP Administration (repeat) Session

You can read more about the topics I covered in this session from my Day 1 post.

Finalizing my session, I had to run quickly over to the Expo hall where I would be mic'ing up to be interviewed live for the first GPUG Amplify live stream event. This was actually a new and innovative approach by Dynamic Communities to get information out in real time to folks who were not able to attend Amplify. The live stream encompassed the views of customers, partners, Microsoft staff, and Microsoft MVPs alike on Amplify. The following is the interview I conducted with host Bob McAdam.


Following my interview, I met up with my good friend Kari-Anne Paterson with Briware Solutions in Oakville, Ontario, Canada. Kari-Anne was up next for a live interview with Bob McAdam.

Me and Kari-Anne Paterson

You can listen to Kari-Anne's interview here.



After Kari-Anne's interview, we decided to go sit at the Mekorma Hub to decompress and catch up. Kari and I share our Caribbean heritage so talking about music and reggae came very natural to us - Kari is Jamaican born. We listened to a few tunes on my computer and the day was over by the time we decided to move on.

I had dinner with my Mekorma colleagues and Njevity folks over at McCormick & Schmick's Grille, where we got to enjoy some good shrimp kisses as you can tell by the picture below.

Chris Dobkins (Njevity), Me, and Craig Klapman (Mekorma)

It was time to go sleep and get some rest for the last day of the conference.

Until next post!

MG.-
Mariano Gomez, MVP