did not get session string

Environment:

TeamSite 7.4.1 on W2K8 R2 (64-bit)

Scenario:

In order to debug an issue, I "shared" the IWHOME directory from the server so I could mount it on my Mac - in so doing I inadvertently prevented everyone else from accessing the directories (yikes!)

I thought I put it back the way it had been (unsharing the directory) but I'm still faced with a problem (small surprise ;-))

Problem:

When I run the workflow (the first task is a CGI Task using iw_cgiwrapper.cgi) - it works just fine, but when the users run it - they get errors, like:

I went through a bunch of threads related to the above error and I believe I can safely say:

It's not because of the absense of IWHOME/tmp/cci (it's there - though I do need to double-check the permissions)
It's not because of bad XML in the workflow
It's not because of an '&' in the job description or file comments.

One suggestion (I believe from @nipper in an old thread) was to use the sample_cgi_task.ipl script. I had the user try to go to:

This leaves me to believe that there may be an issue with permissions for iw_cgi_wrapper.cgi - but I'm not sure how to fix that on Windows (it's not like Unix where there's a setuid bit and owner to check)

Looking for suggestons on how to check / verify / fix the above issue(s)

Find more posts tagged with

Comments

Adam Stoller

FWIW:

(F = "Full control", M = "Modify", X = "Read & execute", L = "List folder contents", R = "Read", W = "Write", S = "Special permissions")

- IWHOME/tmp
  + Everyone: MXLRW (I added MW)  
  + System: FMXLRW
  + TSserver\Administrators: FMXLRWS
- IWHOME/tmp/cci
  + Everyone: MXLRW (MW inherited)
  + System: FMXLRW
  + TSserver\Administrators: FMXLRWS
- IWHOME/httpd
  + Everyone: XLR
  + System: FMXLRW
  + TSserver\Administrators: FMXLRWS
- IWHOME/httpd/iw-bin
  + Everyone: XLR
  + System: FMXLRW
  + TSserver\Administrators: FMXLRWS
- IWHOME/httpd/iw-bin/iw_cgi_wrapper.cgi
  + Owner: Administrators
  + Everyone: XR
  + System: FMXRW
  + TSserver\Administrators: FMXRW

If anyone else using 7.4.1 on W2K8 R2 (64-bit) - or similar (specify distinctions), please let me know if you see anything different on your system with regard to the security properties for the above.

nipper

TS75 Win2008 x64, I have the same setup except I do not have the Special Priv bit set that you mentioned.

For tmp & users I only have RE/L/R

Do not have an Everyone entry in anything

Adam Stoller

I may have to change the Everyone to TSserver\Users - but for now I'll leave Everyone.

Apparently the change to adding MW rights to IWHOME/tmp, IWHOME/tmp/cci, and (due to another issue) ODHOME/tmp seems to have fixed most of the issues.

I now have an issue where impersonation fails for one particular user - looking through the iwtrace.log (which goes all the way back to March 2014) I see:

Error: Impersonation failure user= domain\userid; argcount=5; errCode=1317; cmd=....

Two such errors on September 12, 2014 (script-A)

Four such errors on July 29, 2015 (script-B)

Forty such errors today (August 25, 2015 (script-A)!

What would be the likely reason for authentication failing for just one user running a particular script through the workflows? (other users have run that script through the workflows successfully today)

Adam Stoller

Actually - at least in this case - it might have been due to some other issue (apparently the user in question managed to lock herself out of her account and is currently waiting for someone from their IT department to fix it for her) - so, with any luck, when I get back from lunch - she'll be able to not only login to her workstation but also able to run the script [again].

(sigh)

Adam Stoller

For lack of a better - more thoroughly researched response - I'll take the permission fixes I did this morning as being the "solution".

Once the user got her account unlocked - she was able to run the workflow, including CGI tasks and deployment tasks.

Everything is looking much better tonight :-)