Attempting to perform Enterprise Vault operations that utilize the EVAnon virtual directory from an Outlook Web Access (OWA) session will fail with "Caller is not anonymous user".
book
Article ID: 100023302
calendar_today
Updated On:
Description
Error Message
Enterprise Vault OWA logs:
[RestoreRequest::Send] Unexpected response: OK OK
Dtrace logs (AuthServer):
CClientAuthIntImpl::IsTokenUserAnonUser Caller is not anonymous user
Cause
Enterprise Vault uses an account to request items on behalf of a user for both the Domino Mailbox Archiving Web application and the Enterprise Vault OWA extensions. This account manages anonymous connections from the Domino Server or Exchange Server to the Enterprise Vault server. In previous releases, this account was called the anonymous user account. The account is now called the Data Access account.
Observations:
- Attempting to archive through OWA "No accessible vaults" will be displayed.
- Attempting to open an archived item through OWA will fail; the subsequent EV OWA log will show a successful send request to the EV server and a proper '200' response code however the item will not be restored and an unexpected response will be received:
[EVServerRequest::CreateRequest] Sending request to: http://evserver.domain.local/EVAnon/restoreo2k.asp?vaultid=....
[EVServerRequest::LogResponseHeaders] Status: 200 OK
[RestoreRequest::Send] Unexpected response: OK OK
[RequestProcessor::RestoreAndActOnItem] Item not restored
- A DTrace that includes AuthServer will show:
CClientAuthIntImpl::IsTokenUserAnonUser Caller is not anonymous user.|Caller Sid: S-1-5-21-####-###-###-### (Domain\OWAUser)|Anon Sid: SS-1-5-21-####-###-###-### (Domain\DifferentAccount)
Note: Please see Related Articles section for details on running the Dtrace utility.
Re-running the owauser.wsf script updates the AnonymousUser registry value:
HKEY_CURRENT_USER\Software\KVS\Enterprise Vault\AnonymousUser
However after restarting the Enterprise Vault Admin service the registry value changes to a different account. The issue above is caused when the Anonymous account configured in the EVAnon virtual directory does not match the account set in the Data Access Account tab under the Directory properties in the Vault Administration Console.
Resolution
For both Domino Mailbox Archiving and Enterprise Vault OWA extensions, specify the anonymous account on the Data Access Account tab of Directory properties. For Enterprise Vault OWA extensions the owauser.wsf script must also be run, to configure the account.
When configuring both Domino Mailbox Archiving and Enterprise Vault OWA extensions, the same account must be used for both components.
Note: This account must be the same account as used when running the OWAUser.wsf configuration script. If the account is changed on this tab the OWAUser.wsf script must be re-run to configure the same account for OWA.
Issue/Introduction
Attempting to perform Enterprise Vault operations that utilize the EVAnon virtual directory from an Outlook Web Access (OWA) session will fail with "Caller is not anonymous user".
Was this article helpful?
thumb_up
Yes
thumb_down
No