Member Login

Username
Password
Forget Password
New Sign Up
Search Forum

Buy Support
Incidents

If you can't find your answer in the FREE PUBLIC QDeveloper Forum, require URGENT Priority Support, or you need to send us private or confidential information:

Click Here
If you can't login and post questions or you are having trouble viewing forum posts:
Click Here
Callback
Support

If you live in USA, UK, Canada, Australia or New Zealand, you can leave us details on your question and request us to call you back and discuss them with you personally  (charges apply).

Click Here
 
Buy Support
Incidents
If you can't find your answer in the FREE PUBLIC QDeveloper Forum, require URGENT Priority Support, or you need to send us private or confidential information:
Click Here

Forum : Permissions Issue with IIS using AUTHENTICATED USERSSearch Forum

Forum Home > QODBC - ODBC Driver for QuickBooks > QODBC Installation Support Forum

 New Topic 
 
 Post Reply 
[1]  
 Permissions Issue with IIS using AUTHENTICATED USERS 
 Author   Message 
  Jack 
  
 Group: Members 
 Posts: 7 
 Joined: 2006-08-28 
 Profile
 Posted : 2007-02-05 01:32:55

I am installing an upgrade from QODBC V5 to V7 with server based applications that have been running.

My application requires the user to log on to the IIS using basic authentication, not anonomus logon.
The application uses the user id to determine program flow and options presented.  I have gone through the installation procedures adding AUTHENTICATED USERS wherever I find IIS_USER.  The applications now run so long as the AUTHENTICATED USER is also a member of the ADMINISTRATORS Group, indicating to me that I have missed a permissions setting somewhere along the line.  I have gone back over the setup several times and cannot find what I have missed.  Is there a list of those things which need to have permissions set?

This list would be very helpful.

Jack

 

 

  Top 
  Tom 
  6c3c1_sdk-qodbc.gif
 Group: Administrator 
 Posts: 5510 
 Joined: 2006-02-17 
 Profile
 Posted : 2007-02-05 08:19:01

You need to give all your AUTHENTICATED USERS rights to the C:\Program Files\QODBC Driver for QuickBooks\ using the Security tab.

Give all your AUTHENTICATED USERS and INTERACTIVE accounts permissions to launch and access qbXMLRP2eQODBCInteractive.exe DCOM object using dcomcnfg by doing the following:

1. Launch DCOMCNFG.EXE by clicking the Start button, selecting Run, and typing "Dcomcnfg" in the Run dialog box.

2. Expand the ‘Console Root’ tree to the following: Console Root->Computers->My Computer->DCom Config


 

3. Highlight qbXMLRP2eQODBCInteractive and select Action->Properties from the Main menu (Or right click menu). 

4. In the Security tab select 'Customize’ in the ‘Launch Permissions' frame and click Edit, then add all your AUTHENTICATED USERS, Internet Guest Account (<IUSR_<machine_name>), ASP.NET Machine Account (ASPNET) and INTERACTIVE to the Launch Permissions dialog box.

 

  Top 
  Jack 
  
 Group: Members 
 Posts: 7 
 Joined: 2006-08-28 
 Profile
 Posted : 2007-02-06 01:35:24

I have double checked all these things. 

They are done yet the problem persists.

Any additional thoughts?

 

  Top 
  Tom 
  6c3c1_sdk-qodbc.gif
 Group: Administrator 
 Posts: 5510 
 Joined: 2006-02-17 
 Profile
 Posted : 2007-02-06 08:05:03

Oh, yes, to get rid of the administrator rights problem, you may also need set the permissions of c:\windows\system32\fqqbc32.exe, c:\windows\system32\fqqb32.dll, etc. for each AUTHENTICATED USER.

 

  Top 
  Jack 
  
 Group: Members 
 Posts: 7 
 Joined: 2006-08-28 
 Profile
 Posted : 2007-02-06 13:17:51

Do you understand that AUTHENTICATED USERS is a System managed Group. like IIS_USR?  When you log onto Internet Information Server (IIS) with basic authentication (by entering a user id and password into Internet Explorer), IIS adds you to the AUTHENTICATED USERS group for the duration of your action.  You are re-authenticated at each get or post request when your browser re-submits credentials.  This has worked well in the past.  Keep in mind that I am testing this on the server where I open an Internet Exlorer Browser window and logon to IE as one of my users.  This has nothing to do with the server logon.

When I get my error now, QODBC hangs, I can cancel (close the Browser) and try again. If I then log on as an administrator I can go on.  I do notice that I cannot close Quickbooks after this error, even if I successfully use the interface as an administrator.  QB reports that there is still an application attached to the company file.  I have to use the task manager to kill QB.

Might the single user nature of the optomizer be my problem?  I think not, otherwise, why would it work with multiple administrator accounts, none of which were used to install the QODBC and or Quickbooks on the server?

Keep in mind that I can make this work for any user simply by adding them to the DOMAIN_ADMINISTRATORS group.

Bye the way we are approaching critical on this installation, we must make this work soon!

Thank you

Jack

 

  Top 
  Jack 
  
 Group: Members 
 Posts: 7 
 Joined: 2006-08-28 
 Profile
 Posted : 2007-02-06 13:20:10

An additional thought.
Does the optomizer run as a seperate task?  Do I need to find it and grant start and run rights for AUTHORIZED USERS?

 

 

 

  Top 
  Tom 
  6c3c1_sdk-qodbc.gif
 Group: Administrator 
 Posts: 5510 
 Joined: 2006-02-17 
 Profile
 Posted : 2007-02-06 14:45:28

The QODBC Server Edition is designed to be used by an account with admistrative rights running on the server console (local session), if adding AUTHENTICATED USERS to the DOMAIN_ADMINISTRATORS group solves your issues, then that would be the approach to take.

The QODBC Optimizer is single user only. By that we mean that each Windows account user must have their own companyfilename.opt file. To make this work we added the following to QODBC v7:

  • Moved trace and error logs to %userprofile%\QODBC Driver for QuickBooks folder.
  • Moved default Optimizer folder to %userprofile%\QODBC Driver for QuickBooks
  • Now save all global settings in %allusersprofile%\QODBC Driver for QuickBooks\ODBCINST.INI.

    Which automatically moves the optimizer and error logs files under the Windows account QODBC is running under. The default location of the .opt tables are now found in your login user profile. Swap 'Tom' in the below with your Windows ADMINISTRATOR/SYSTEM login name.

     

  •  

      Top 
      Jack 
      
     Group: Members 
     Posts: 7 
     Joined: 2006-08-28 
     Profile
     Posted : 2007-02-07 17:11:53

    After a great deal of work I have made this work.  I selected one user who was not an administrator.
    I verified that this person was unable to access QB through my application.
    I added this person to the administrators group and verified that they could then access QB without a problem.
    I removed them from the administrators group. again verified they are unable to access QB.

    Then, following your instructions:
    - I logged onto the server as that person and installed QODBC without entering the cd code.
    - I verified that the user copy of Optomizer was created as you said it would be.
    - I repaired the permissions to launch and access qbXMLRP2eQODBCInteractive.exe
    - I restarted the server logging on as the administrator.
    - I started QuickBooks
    - I verified proper operation of my program to access QB using the administrator logon to IIS, It worked well, as it had before.
    - I then opened a new browser and logged on as the user whom I had just setup by loading QODBC.
    - That person was still not able to access QB.  There was no change to the situation.

    I SEARCHED MY ENTIRE SERVER FOR ANY FILES WITH NAMES CONTAINING THE STRING 'QODBC' OR 'FLEX'.
    I ADDED 'AUTHENTICATED USERS' AND 'INTERACTIVE' WITH FULL CONTROL TO EVERY FOLDER THAT CONTAINED ANY OF THESE FILES.

    THIS FIXED THE PROBLEM!
    MY SYSTEM NOW RUNS, ALL USERS ARE ABLE TO USE QB THROUGH THE IIS APPLICATIONS.

    AS I HAD SUSPECTED THERE IS SOME FILE SOMEWHERE THAT IS NEEDED THAT IS NOT IN THE SETUP INSTRUCTIONS.

    HERE ARE SOME OBSERVATIONS:

    1. The QODBC processes seem to run under the permissions of the user who logged onto the server and started Quickbooks.  It is that users optomiser files that get used, regardless of who logges onto IIS and becomes the AUTHENTICATED USERS. This can be verified by checking the timestamp on the OPTOMIZER files.
    2. You need to come up with a list of files and programs that have to be granted permissions for this to work.  I cannot be the only person to work with the AUTHENTICATED USERS group in this way.
    3. My approach of shotgunning the system, granting full control wherever I find QODBC or FLEX is poor at best.  I will have to go back and remove the unnecessary permissions one at a time until the system fails.  I will do this as soon as the client cools off from the excessive time expended on this installation.

    Thank you for your attention:

    Jack

     

      Top 
      Tom 
      6c3c1_sdk-qodbc.gif
     Group: Administrator 
     Posts: 5510 
     Joined: 2006-02-17 
     Profile
     Posted : 2008-09-05 07:59:31
    Thank you for your comments and valuable insights to your setup. While the basics are covered in: How can I see QuickBooks data in a Internet Explorer Browser using Windows XP?  and above, we cannot provide support for implementing your company's Windows security and group policy. Please consult your Windows documentation or a Qualified Information Technology Expert for further assistance on this. 

      Top 
     New Topic 
     
     Post Reply 
    [1]  

    Jump to