SOLVED
Home

Skype autodiscover authentication

%3CLINGO-SUB%20id%3D%22lingo-sub-386705%22%20slang%3D%22en-US%22%3ESkype%20autodiscover%20authentication%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-386705%22%20slang%3D%22en-US%22%3E%3CP%3EHello%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Ewe%20are%20currently%20migrating%20from%20Lync%202010%20server%20to%20Skype%20for%20Business%202015%20server.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EA%20user%20migrated%20to%20the%20skype%20pool%20is%20able%20to%20log%20on%20a%20windows%207%20machine%20using%20Lync%202010%20Client.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EOn%20a%20Windows%2010%20Machine%20with%20Lync%202013%20client%2C%20the%20logon%20does%20not%20work%20and%20credentials%20are%20asked.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Ethe%20autodiscover%20service%20seems%20to%20be%20able%20to%20discover%20the%20correct%20url%20(the%20pool%20real%20name%20was%20replaced%20by%20pool01.domain.com).%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Ethe%20error%20we%20get%20is%20(translated%20from%20french%20error%20message)%3C%2FP%3E%3CP%3Ean%20error%20happened%20during%20the%20communication%20with%20endpoint%20on%20%C2%AB%20%3CA%20href%3D%22https%3A%2F%2Fpool01.domain.com%2FWebTicket%2FWebTicketService.svc%22%20target%3D%22_blank%22%20rel%3D%22noopener%20nofollow%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fpool01.domain.com%2FWebTicket%2FWebTicketService.svc%3C%2FA%3E%C2%BB.%3C%2FP%3E%3CP%3Ethe%20server%20sent%20a%20HTTP%20State%20%C2%AB%20401%20(0x191)%20%C2%BB%20with%20text%20%C2%AB%20Unauthorized%20%C2%BB.%3C%2FP%3E%3CP%3Ethe%20requested%20resource%20requires%20an%20user%20authentication%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-386705%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3ESign-in%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-388691%22%20slang%3D%22en-US%22%3ERe%3A%20Skype%20autodiscover%20authentication%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-388691%22%20slang%3D%22en-US%22%3E%3CP%3Ewell%2C%20it%20turns%20out%20that%20it%20was%20a%20kerberos%20problem.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20noticed%20this%20message%20in%20the%20client%20%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThe%20Kerberos%20client%20received%20a%20KRB_AP_ERR_MODIFIED%20error%20from%20the%20front-end-name%24%20server.%20The%20target%20name%20used%20was%20HTTP%20%2F%20skype01.domain.com.%20This%20indicates%20that%20the%20target%20server%20failed%20to%20decrypt%20the%20ticket%20provided%20by%20the%20client.%20This%20may%20occur%20when%20the%20target%20primary%20server%20name%20(SPN)%20is%20registered%20to%20a%20different%20account%20than%20the%20one%20used%20by%20the%20target%20service.%20Ensure%20that%20the%20target%20SPN%20is%20registered%20only%20on%20the%20account%20used%20by%20the%20server.%20This%20error%20can%20also%20occur%20if%20the%20target%20service%20account%20password%20differs%20from%20what%20is%20configured%20on%20the%20Kerberos%20Key%20Distribution%20Center%20for%20this%20target%20service.%20Ensure%20that%20the%20service%20on%20the%20server%20and%20Kerberos%20Key%20Distribution%20Center%20are%20both%20configured%20to%20use%20the%20same%20password.%20If%20the%20server%20name%20is%20not%20complete%2C%20and%20the%20target%20domain%20(DOMAIN.COM)%20differs%20from%20the%20client%20domain%20(DOMAIN.COM)%2C%20check%20if%20there%20are%20server%20accounts%20with%20the%20same%20name%20in%20both%20domains%2C%20or%20use%20the%20full%20name%20to%20identify%20the%20server.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Esearching%20for%20this%20error%2C%20I%20found%20that%20there%20was%20a%20powershell%20command%20to%20test%20kerberos%20account%20assignment%20(Test-CsKerberosAccountAssignment).%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIt%20returned%20this%20error%20%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThe%20Kerberos%20configuration%20on%20front-end.domain.com%20is%20invalid.%20The%20expected%3CBR%20%2F%3Eassigned%20account%20is%20domain.com%5Clynckerbacct.%20Ensure%20that%20the%20account%20has%20not%20expired%2C%20and%20the%20configured%20password%20on%3CBR%20%2F%3Ethe%20machine%20matches%20the%20Active%20Directory%20password%20of%20the%20account.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Eso%20using%20those%20addresses%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fsupport.microsoft.com%2Fen-sg%2Fhelp%2F2796134%2Flync-server-test-cskerberosaccountassignment-powershell-command-fails%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fsupport.microsoft.com%2Fen-sg%2Fhelp%2F2796134%2Flync-server-test-cskerberosaccountassignment-powershell-command-fails%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Eand%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CA%20href%3D%22http%3A%2F%2Fhowdouc.blogspot.com%2F2011%2F07%2Fkerberos-web-authentication-for-lync.html%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttp%3A%2F%2Fhowdouc.blogspot.com%2F2011%2F07%2Fkerberos-web-authentication-for-lync.html%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20launched%20the%20command%26nbsp%3BSet-CsKerberosAccountPassword%20-UserAccount%20domain.com%5Clynckerbacct%20and%20after%20that%2C%20no%20more%20error%20with%26nbsp%3BTest-CsKerberosAccountAssignment%20and%20the%20Lync%202013%20client%20was%20able%20to%20log%20on%20without%20problem.%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
lprotti
Occasional Contributor

Hello,

 

we are currently migrating from Lync 2010 server to Skype for Business 2015 server.

 

A user migrated to the skype pool is able to log on a windows 7 machine using Lync 2010 Client.

 

On a Windows 10 Machine with Lync 2013 client, the logon does not work and credentials are asked.

 

the autodiscover service seems to be able to discover the correct url (the pool real name was replaced by pool01.domain.com).

 

the error we get is (translated from french error message)

an error happened during the communication with endpoint on « https://pool01.domain.com/WebTicket/WebTicketService.svc ».

the server sent a HTTP State « 401 (0x191) » with text « Unauthorized ».

the requested resource requires an user authentication

 

 

1 Reply
Solution

well, it turns out that it was a kerberos problem.

 

I noticed this message in the client :

 

The Kerberos client received a KRB_AP_ERR_MODIFIED error from the front-end-name$ server. The target name used was HTTP / skype01.domain.com. This indicates that the target server failed to decrypt the ticket provided by the client. This may occur when the target primary server name (SPN) is registered to a different account than the one used by the target service. Ensure that the target SPN is registered only on the account used by the server. This error can also occur if the target service account password differs from what is configured on the Kerberos Key Distribution Center for this target service. Ensure that the service on the server and Kerberos Key Distribution Center are both configured to use the same password. If the server name is not complete, and the target domain (DOMAIN.COM) differs from the client domain (DOMAIN.COM), check if there are server accounts with the same name in both domains, or use the full name to identify the server.

 

searching for this error, I found that there was a powershell command to test kerberos account assignment (Test-CsKerberosAccountAssignment).

 

It returned this error :

 

The Kerberos configuration on front-end.domain.com is invalid. The expected
assigned account is domain.com\lynckerbacct. Ensure that the account has not expired, and the configured password on
the machine matches the Active Directory password of the account.

 

so using those addresses

 

https://support.microsoft.com/en-sg/help/2796134/lync-server-test-cskerberosaccountassignment-powers...

 

and 

 

http://howdouc.blogspot.com/2011/07/kerberos-web-authentication-for-lync.html

 

I launched the command Set-CsKerberosAccountPassword -UserAccount domain.com\lynckerbacct and after that, no more error with Test-CsKerberosAccountAssignment and the Lync 2013 client was able to log on without problem.