Insufficient authorization to perform this action error on Web Ser

Discussion:

(too old to reply)

Steve

2009-07-21 15:05:02 UTC

Hi,

I am very new and very green when it comes to Dynamics GP. Currently I am
trying to build soap messages within SoapUI to send to my Dynamics GP Web
Service to see what I need verses what I get back.

The long term goal being to reproduce this work in a LiveCycle form.

What I am trying to do first is to perform a simple GetCompanyList call.
I've tried compiling the included sample code in the SDK and I've built a
soap request message in SoapUI in response message I get "Insufficient
authorization to perform this action."

Now I have created a special "WebService" account in GP that I am able to
use in my GP client to login a perform actions. Obviously I am missing
something along the way. Any suggestions and help would be greatly
appreciated.

Thanks,

Steve

Mariano Gomez

2009-07-21 18:11:01 UTC

Permalink

A couple things:

- I am not sure I am familiar with soapUI, so I can't help you there.
- Check your security using the Dynamics Security Administration console and
make sure your web service account has been assigned a role or has access to
the necessary tasks you are trying to execute.

Best regards,
--
MG.-
Mariano Gomez, MIS, MCP, PMP
Maximum Global Business, LLC
http://www.maximumglobalbusiness.com
The Dynamics GP Blogster at http://dynamicsgpblogster.blogspot.com

Post by Steve
Hi,
I am very new and very green when it comes to Dynamics GP. Currently I am
trying to build soap messages within SoapUI to send to my Dynamics GP Web
Service to see what I need verses what I get back.
The long term goal being to reproduce this work in a LiveCycle form.
What I am trying to do first is to perform a simple GetCompanyList call.
I've tried compiling the included sample code in the SDK and I've built a
soap request message in SoapUI in response message I get "Insufficient
authorization to perform this action."
Now I have created a special "WebService" account in GP that I am able to
use in my GP client to login a perform actions. Obviously I am missing
something along the way. Any suggestions and help would be greatly
appreciated.
Thanks,
Steve

Janakiram M.P.

2009-07-21 18:30:01 UTC

Permalink

Steve,
You can add your userID as SuperUser in Webservices by going to security
Admin console and then it should be good to go, i guess
--
Thanks
Janakiram M.P.
MCP-GP
http://janakirammp.blogspot.com

Steve

2009-07-21 19:41:02 UTC

Permalink

Great, that worked. It took a while for the changes to be cached, but it
worked.

Thanks,

Steve

Post by Janakiram M.P.
Steve,
You can add your userID as SuperUser in Webservices by going to security
Admin console and then it should be good to go, i guess
--
Thanks
Janakiram M.P.
MCP-GP
http://janakirammp.blogspot.com

Patrick [MSFT]

2009-07-23 04:05:46 UTC

Permalink

yes, it takes 20 minutes for security changes. or if you can do an iisreset
and that will force the changes immediately.

patrick
dev support
--
This posting is provided "AS IS" with no warranties, and confers no rights.

Post by Steve
Great, that worked. It took a while for the changes to be cached, but it
worked.
Thanks,
Steve

Steve

2009-07-23 18:33:01 UTC

Permalink

Ok, I have working soap messages from SoapUI. Through this tool I am able to
create simple soap requests for GetCompanyList and GetCustomerList.

The problem is now that I am trying to implement this within a LiveCycle
form, I am running up against this authentication problem again. According
to the documentation if you install web services using an account defined on
the local machine, then by default the web services should be using Kerberos.

What we would like to know is what kind of mechanism the Dynamics GP web
services support for validating userid and password.

Here is a copy of the soap I've successfully used from SoapUI:

Authorization: NTLM
TlRMTVNTUAADAAAAGAAYAGQAAAAAAAAAfAAAAA0ADQBAAAAACgAKAE0AAAANAA0AVwAAAAAAAAB8AAAABlIAAERZTkFNSUNTR1BERVZXRUJTRVJWSUNFRFlOQU1JQ1NHUERFVjN4UMufqu+Q2gz+MI6nxQce8nQ9cImZ+A==
Host: dynamicsgpdev
Content-Length: 1368
User-Agent: Jakarta Commons-HttpClient/3.0.1
Content-Type:
application/soap+xml;charset=UTF-8;action="http://schemas.microsoft.com/dynamics/gp/2006/01/GetCustomerList"

<soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope"
xmlns:ns="http://schemas.microsoft.com/dynamics/gp/2006/01"
xmlns:ns1="http://schemas.microsoft.com/dynamics/2006/01"
xmlns:ns2="http://schemas.microsoft.com/dynamics/security/2006/01">
<soap:Header/>
<soap:Body>
<ns:GetCustomerList>

<ns:criteria>

<ns:Name>

<ns:Items />

<ns:Like>%</ns:Like>
</ns:Name>
<ns:Scope>Return All</ns:Scope>
</ns:criteria>
<ns1:Context xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns="http://schemas.microsoft.com/dynamics/2006/01">

<ns1:OrganizationKey xsi:type="CompanyKey">
<Id>-1</Id>
</ns1:OrganizationKey>

<ns1:CultureName>en-US</ns1:CultureName>
<ns1:CurrencyType>Transactional</ns1:CurrencyType>

<ns1:RoleKey>

<ns2:Id>e18b321a-9548-48fb-b75a-dee0a618ddaa</ns2:Id>
</ns1:RoleKey>
</ns1:Context>
</ns:GetCustomerList>
</soap:Body>
</soap:Envelope>

As always, any help is greatly appreciated.

Thanks,

Steve

Post by Patrick [MSFT]
yes, it takes 20 minutes for security changes. or if you can do an iisreset
and that will force the changes immediately.
patrick
dev support
--
This posting is provided "AS IS" with no warranties, and confers no rights.

Post by Steve
Great, that worked. It took a while for the changes to be cached, but it
worked.
Thanks,
Steve

Chris Roehrich [MSFT]

2009-07-24 13:32:03 UTC

Permalink

Steve,

The GP web services application in IIS uses Windows Integrated
authentication. So the authentication that takes place is handled by
Windows Server\IIS. Unfortunately we do not have any documentation on what
you are trying to accomplish since we really only support using a Visual
Studio development (2005\2008\Express) environments. So creating SOAP and
specifically the authentication header is not something that is a concern.
I appreciate the fact you are attempting to use GP Web Services with
LiveCycle (looks like an Adobe product) but unfortunately we do not test
all the other different types of developer tools out there.

If you can successfully connect with SoapUI I am not sure why it would be
different than LiveCycle. A suggestion I have is to compile one of the
sample SDK applications we have using Visual Studio. Then run the
solution and use the Fiddler tool at the same to see what is being passed
in the header for the Authorization. I did this against a web services
installation where the gp web services is running under a local computer
account so it would be Kerberos from what the documentation says. When I
run fiddler and look at the raw message, it says the below. So it looks
like Authorization should be set to Negotiate and not NTLM. Good luck
with your integration!

Thanks,
Chris Roehrich

POST /DynamicsGPWebServices/DynamicsGPService.asmx HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; MS Web Services Client
Protocol 2.0.50727.4918)
VsDebuggerCausalityData:
uIDPo9u4yl7F8jlCiR05zIqq5CUAAAAAJ6YZ9j0seEKFsaOlb2dZKFpx04NiP6BJvDyvd4hD9lAA
CQAA
Content-Type: text/xml; charset=utf-8
SOAPAction:
"http://schemas.microsoft.com/dynamics/gp/2006/01/GetSalesOrderByKey"
Authorization: Negotiate
TlRMTVNTUAADAAAAGAAYAI4AAADsAewBpgAAABQAFABYAAAAEAAQAGwAAAASABIAfAAAABAAEACS
AgAANYKI4gYBvBsAAAAP3LlPIP4e/uq5wFTg/EqAi24AZABzAHUAYgBpAHMAbwBuADEAZQBDAG8A
bgBuAGUAYwB0AEMAUgBPAEUASABSAEkAQwAxAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABrmtGhU
zotMMcQzrmgXDg4BAQAAAAAAAJa7knFhDMoBLvjlPCvTssgAAAAAAgAYAE4ATwBSAFQASABBAE0A
RQBSAEkAQwBBAAEAFABOAEQAUwBVAEIASQBTAE8ATgAxAAQAPgBuAG8AcgB0AGgAYQBtAGUAcgBp
AGMAYQAuAGMAbwByAHAALgBtAGkAYwByAG8AcwBvAGYAdAAuAGMAbwBtAAMAVABuAGQAcwB1AGIA
aQBzAG8AbgAxAC4AbgBvAHIAdABoAGEAbQBlAHIAaQBjAGEALgBjAG8AcgBwAC4AbQBpAGMAcgBv
AHMAbwBmAHQALgBjAG8AbQAFACQAYwBvAHIAcAAuAG0AaQBjAHIAbwBzAG8AZgB0AC4AYwBvAG0A
BwAIAJa7knFhDMoBBgAEAAIAAAAIADAAMAAAAAAAAAAAAAAAADAAAGaMKJCSq6z4EnrO93DPCby0
zIPFrGPsfu0QC5+otFxNCgAQAAAAAAAAAAAAAAAAAAAAAAAJAF4ASABUAFQAUAAvAG4AZABzAHUA
YgBpAHMAbwBuADEALgBuAG8AcgB0AGgAYQBtAGUAcgBpAGMAYQAuAGMAbwByAHAALgBtAGkAYwBy
AG8AcwBvAGYAdAAuAGMAbwBtAAAAAAAAAAAAAAAAAAVhAJSoleEMNEBZFMZ3LZs=
Host: ndsubison1
Content-Length: 588
Expect: 100-continue

<?xml version="1.0" encoding="utf-8"?><soap:Envelope
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:xsd="http://www.w3.org/2001/XMLSchema"><soap:Body><GetSalesOrderByKey
xmlns="http://schemas.microsoft.com/dynamics/gp/2006/01"><key><Id>ORDST2233<
/Id></key><Context
xmlns="http://schemas.microsoft.com/dynamics/2006/01"><OrganizationKey
xsi:type="CompanyKey"><Id>-1</Id></OrganizationKey><CultureName>en-US</Cultu
reName><CurrencyType>Transactional</CurrencyType></Context></GetSalesOrderBy
Key></soap:Body></soap:Envelope>

Beth Gardner [Msft]

2009-07-27 17:00:02 UTC

Permalink

Hello Steve,

I am following up with this to find out if your issue has been resolved.

Let me know.

Thanks,
Beth Gardner

Steve

2009-07-27 19:45:01 UTC

Permalink

Hi Beth,

Thanks for following up.

Rather then try beating my head against this authorization wall any more, I
had decided to try a different approach. I created an intermediary web
service using .Net to receive the soap from my LiveCycle apps and reformat
them using the Dynamics GP web services to talk to my Dynamics DP development
server.

This worked.... on Friday.

Today I was getting those insufficient Authorization errors once again. My
soap messages from SoapUI that worked last week, didn't work today either. I
verified, my web service login id, everything seemed good, but no
authorization. Also, one of the web services I created was telling me that
this company I was requesting did not exist. (Fabrikam) This is despite the
fact I could log into the user tool and see the company.

So I thought to myself, "this is Microsoft product, and when in doubt with
Microsoft, reboot!" Strangely enough or maybe not so strange, that worked.
Go figure.

So I seem to be back on track now, but are there any issues around the
authorization issue I just described? Are there any patches or such I should
have before I move to production? I imagine rebooting our production machine
every few days to resolve authorization issues will not go over very well.

Thanks,

Steve

Post by Beth Gardner [Msft]
Hello Steve,
I am following up with this to find out if your issue has been resolved.
Let me know.
Thanks,
Beth Gardner

Beth Gardner [Msft]

2009-07-28 13:40:10 UTC

Permalink

Hi Steve,

What we support is Visual Studio and so we don't have to worry about the
Authorization piece so I don't think that I can really give you a good
answer to your question since this is out of our area of expertise. We
don't know of any known issues with Authorization because it is all handled
by IIS.

Thanks,

Beth Gardner
Microsoft Online Support Engineer - MBS Developer Support

Get Secure! - www.microsoft.com/security

=============================================
When responding to posts, please "Reply to Group" via
your newsreader so that others may learn and benefit
from your issue.
=============================================
This posting is provided "AS IS" with no warranties, and confers no rights.

Beth Gardner [Msft]

2009-07-31 20:33:58 UTC

Permalink

Hi Steve,

I am just following up with you to find out if you have any thing more for
us on this post.

Let us know.

Thanks,
Beth Gardner
Microsoft Online Support Engineer - MBS Developer Support

Get Secure! - www.microsoft.com/security

=============================================
When responding to posts, please "Reply to Group" via
your newsreader so that others may learn and benefit
from your issue.
=============================================
This posting is provided "AS IS" with no warranties, and confers no rights.

j***@gmail.com

2016-07-24 23:25:52 UTC

Permalink

Post by Steve
Ok, I have working soap messages from SoapUI. Through this tool I am able to
create simple soap requests for GetCompanyList and GetCustomerList.
The problem is now that I am trying to implement this within a LiveCycle
form, I am running up against this authentication problem again. According
to the documentation if you install web services using an account defined on
the local machine, then by default the web services should be using Kerberos.
What we would like to know is what kind of mechanism the Dynamics GP web
services support for validating userid and password.
Authorization: NTLM
TlRMTVNTUAADAAAAGAAYAGQAAAAAAAAAfAAAAA0ADQBAAAAACgAKAE0AAAANAA0AVwAAAAAAAAB8AAAABlIAAERZTkFNSUNTR1BERVZXRUJTRVJWSUNFRFlOQU1JQ1NHUERFVjN4UMufqu+Q2gz+MI6nxQce8nQ9cImZ+A==
Host: dynamicsgpdev
Content-Length: 1368
User-Agent: Jakarta Commons-HttpClient/3.0.1
application/soap+xml;charset=UTF-8;action="http://schemas.microsoft.com/dynamics/gp/2006/01/GetCustomerList"
<soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope"
xmlns:ns="http://schemas.microsoft.com/dynamics/gp/2006/01"
xmlns:ns1="http://schemas.microsoft.com/dynamics/2006/01"
xmlns:ns2="http://schemas.microsoft.com/dynamics/security/2006/01">
<soap:Header/>
<soap:Body>
<ns:GetCustomerList>

<ns:criteria>

<ns:Name>

<ns:Items />

<ns:Like>%</ns:Like>
</ns:Name>
<ns:Scope>Return All</ns:Scope>
</ns:criteria>
<ns1:Context xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns="http://schemas.microsoft.com/dynamics/2006/01">

<ns1:OrganizationKey xsi:type="CompanyKey">
<Id>-1</Id>
</ns1:OrganizationKey>

<ns1:CultureName>en-US</ns1:CultureName>
<ns1:CurrencyType>Transactional</ns1:CurrencyType>

<ns1:RoleKey>

<ns2:Id>e18b321a-9548-48fb-b75a-dee0a618ddaa</ns2:Id>
</ns1:RoleKey>
</ns1:Context>
</ns:GetCustomerList>
</soap:Body>
</soap:Envelope>
As always, any help is greatly appreciated.
Thanks,
Steve

Post by Steve
Great, that worked. It took a while for the changes to be cached, but it
worked.
Thanks,
Steve

Hello Steve,

I understand you successfully consume a gp web service from soapui.
I've tried, with no luck, to create simple soap requests for GetCustomerList using soapui. I've also used your soap message and it didn't work.

Your example is for a native or legacy endpoint?
Do you have any particular configuration of the wshttpbindings in the web service config file?
How should I authenticate using soapui, is there anything particular?

Thank you,
JC