Upgrade issue from OnBase 18 SP1 to OnBase Foundation EP2

[Narasimha_Cima1]

We have upgraded our OnBase Development system from version 18 SP1 to OnBase Foundation EP2. After the upgrade we are having issues logging to the Web Client using Auto Login. When we set it Force OnBase Authentication it works and when set to Interactive User Authentication for Core Services it works fine.

The following is the error we get and "CD-OBS" is the domain admin account.

Hyland.Core.AuthenticationException: Failed to connect. User 'CD-OBS' does not belong to any group that exists in both 131586 and datasource.
at Hyland.Core.Authentication.CoreAuthnResultUserFinalizer.SyncUserGroups(Session session, User user, CoreAuthnResult result, Boolean throwIfNoMatchingGroupsFound, Boolean alwaysRemoveAllGroups)
at Hyland.Core.Authentication.AutoLogonHandler`2.FinalizeUser(IdPToken token, CoreAuthnResult result, UserType type, Session session)
at Hyland.Core.Authentication.CoreAuthnResultUserFinalizer.FinalizeUser(CoreAccessToken token, UserType type, Session session)
at Hyland.Core.Authentication.Login.CompleteUserValidation(Session session, CoreAccessToken token)
at Hyland.Core.Authentication.Authenticator.FinalizeAuthentication(Session session, CoreAccessToken token)
at Hyland.Core.Session.Connect(AuthenticationProperties authProps)
at Hyland.Services.AppServices.Connect(AuthenticationProperties properties)
at Hyland.Core.ServiceHandlers.Login.Connect(AuthenticationProperties authenticationProperties, Properties props, ClientMachineInfo clientMachineInfo)
at Hyland.Core.ServiceHandlers.Login.AuthenticateAutoLogin(AuthProps authProps, Properties props, ClientMachineInfo clientMachineInfo, SystemProperties systemProps)
at Hyland.Core.ServiceHandlers.Login.Authenticate()

[Tony_Lovell]

Hello,

Have you configured AD-Enhanced directory service authentication now that they're on Foundation?

[Scott_Johnson3 · Accepted solution]

Hi Narasimha,

I am also dealing with these issues.  They broke a bunch of users setups with the new web server builds.   You should check out this white paper by Adam Shane: https://community.hyland.com/gallery/items/50913-network-security-white-paper

Hope this helps.

Scott

[AdamShaneHyland]

To Scott's point,  there were changes made to the software which were implemented in OnBase 18.0.1.67 as part of a Security Bulletin (link) (including OnBase Foundation EP1 and higher).  The documentation referenced above covers all of the configuration steps need to implement the non-interactive autologon.  You can reference the section titled "Special Considerations for Optimized Windows Authentication and Autologon".

[Daniel_Hansen]

@Adam Shane , can you confirm if the SPN record is needed when both the web and app server are on the same machine?  Thanks.