The account running the IIS Application Pool leveraged by the PowerPivot System Service requires Full Read on any Web Application with the PowerPivot Service Application Proxy. However, the health rule governing validating this is true does not function correctly. The error in Review Problems and Solutions is: MidTier process account should have ‘Full Read’ permission on all associated SPWebApplications Let’s dive in to why this is happening, and how to resolve it. The first thing the Health Rule does is retrieve the process account name from the IIS Application Pool: [crayon-54b74ba2ce592316475999/] The equivalent PowerShell is: [crayon-54b74ba2ce5a7745516486/] Once the Health Rule has the process account, the next step is to identify who has FullRead rights in the SPPolicy on the Web Application. [crayon-54b74ba2ce5b0041859859/] Now, here is where it fails. [crayon-54b74ba2ce5b9657798128/] What the above code is doing is validating that the strings are equal. It is comparing the UserName on the SPPolicy to the Process Account running is the IIS Application Pool. In a claims-enabled environment, this is never true as the claims identifier on the SPPolicy isn’t equal to the Process Account. As for a resolution, simply disable the rule and manually add the ProcessAccountName to the Web Application(s) with Full Read rights. This can be done via PowerShell: [crayon-54b74ba2ce5c2678595923/] What about the automatic repair, and why doesn’t that seem to work? Pretty simple, and the issue is along the same lines. What the automatic repair does it first look at a Web Application, then proceed to enumerate each User Policy on that Web Application. For each user, it adds Full Read rights (even though that user isn’t the one running the IIS Application Pool the PowerPivot Service Application is assigned to). [crayon-54b74ba2ce5cb382342988/] The equivalent PowerShell code is: [crayon-54b74ba2ce5d3460866830/] When it does this, it grabs the username (say “i:0#w|domain\username”) and calls SPWebApplication.GrantAccessToProcessIdentity. This method is unable to translate the claim value into a Windows Identity, thus we receive the exception “Some or all identity references could not be translated” and the the repair process exits.
The post PowerPivot Mid-Tier Process Account Does Not have Full Read appeared first on Nauplius.
