CWA 2007 R2 Login Fails

Ran into this bug today while trying to deploy Communicator Web Access 2007 R2 on Windows Server 2008. Apparently the SPN isn’t registered properly during the installation process which causes integrated authentication to fail. After you try to sign in you’ll see this error:

Cannot sign in because your computer clock is not set correctly or your account is invalid.(Error code: 0-1-492)

image

Jason Shave ran across this same issue a few weeks ago and has a nice explanation on how to add the SPN to your CWAService account.

I had to restart the CWA virtual server before the SPN change took effect, but after that CWA logged in just fine:

image

Peanut Gallery

  1. 1 Kamil

    Hi, i have the same issue on Windows 2008. Can you explain how to add SPN to CWA Service account? Link that you have put into this post does not work anymore.

    BR Kamil

     
  3. 3 CeGe

    Hi, I have the same problem as well, can you please post the walkaround?

    Brgrds CeGe

     
  4. 4 Tom Pacyk

    Good find Brian. I’ll post the steps from the cached page here as well:

    1. Open ADSIEDIT and navigate to the OU where your CWA service account is stored.
    2. Locate the CWA service account (mine is called ‘CWAService’) and right-click then choose Properties.
    3. Turn on the checkbox to ‘Show only attributes that have values’ and scroll down to an entry called ’servicePrincipalName’.
    4. Click the Edit button.
    5. Type in the SPN using the following format (http/). For example, if your site is called “cwa.intel.com” then type in “http/cwa.intel.com”. NOTE: Do NOT type http://.
    6. Click OK and you’re done!
     
  5. 5 Kamil

    Thanks guys, it work fine with this correction.

    I have also some other problem. maybe some of you know what might be the issue?

    I’m able to login to internal virtual server as well as to external virtual server published with ISA 2006. I’m able to start IM in both directions (external user internal user). I’m able to start desktop sharing from internal user to external.

    I’m not able to start desktop sharing from external user to internal. I receive information: “Cannot start desktop sharing session currently”. Internal user doesn’t even receive invitation to desktop sharing. I can’t see any errors in snooper… But i can analyze only Edge and Front End. There is no logging tool for CWA server or client.

    Did some of you met such problem?

     
  6. 6 Kamil

    Hi,

    I finally found the reason of that failure!

    I was missing SP1 on my ISA server… I forgot to install it in my test environment. With SP1 everything works just fine!

    BR Kamil

     

Speak Up