Skip to main content
 

"MapToWindows: Failed to map to windows" error appears in event logs

kbt146511

PRODUCT
K2 Five
This article was created in response to a support issue logged with K2. The content may include typographical errors and may be revised at any time without notice. This article is not considered official documentation for K2 software and is provided "as is" with no warranties.

Issue

This error appears in the event logs:

 

MapToWindows: Failed to map to windows: System.ServiceModel.FaultException`1`System.ServiceModel.ExceptionDetail]: WTS0003: The caller is not authorized to access the service. (Fault Detail is equal to An ExceptionDetail, likely created by IncludeExceptionDetailInFaults=true, whose value is: System.UnauthorizedAccessException: WTS0003: The caller is not authorized to access the service. at Microsoft.IdentityModel.WindowsTokenService.CallerSecurity.CheckCaller(WindowsIdentity callerIdentity) at Microsoft.IdentityModel.WindowsTokenService.S4UServiceContract.PerformLogon(Func`1 logonOperation, Int32 pid) at Microsoft.IdentityModel.WindowsTokenService.S4UServiceContract.UpnLogon(String upn, Int32 pid) at SyncInvokeUpnLogon(Object , Objectc] , Objectc] ) at System.ServiceModel.Dispatcher.SyncMethodInvoker.Invoke(Object instance, Objectc] inputs, Objectc]& outputs) at System.ServiceModel.Dispatcher.DispatchOperationRuntime.InvokeBegin(MessageRpc& rpc) at System.ServiceModel.Dispatcher.ImmutableDispatchRuntime.ProcessMessage5(MessageRpc& rpc) at System.ServiceModel.Dispatcher.ImmutableDispatchRuntime.ProcessMessage41(MessageRpc& rpc) at System.ServiceModel.Dispatcher.Immutable...).

 

 

Symptoms

The symptoms consist of the above exception appearing in the event viewer and end user/administrator thinking there is an underlying issue somewhere in the configuration. The text below specifies how to get rid of the exception given the circumstances.

Resolution

If the exception message appears, the end user/administrator needs to identify whether the connected windows user needs to be used, when connecting to any other LOB system like SAP, SQL, etc. where that system only accepts "pure windows".

 

(I.e. SharePoint 2013 and up uses OAuth so no need for windows authorisation to flow through). 

 

If the end user/administrator sets all service instances that connect to these LOB systems to use Service Account authentication, then they do not need "pure windows" authorisation to flow through. This means the K2 Claims to Windows token service doesn’t need to be configured. Also, if that is the case, the MapToWindows setting in the SmartForms web.config file can be switched off.

 

If you set MapToWindows to off, don't forget to un comment the line 6 of the web.config:

<section name="sourceCode.identityModel" type="SourceCode.Security.Claims.Web.Configuration, SourceCode.Security.Claims.Web, Version=4.0.0.0, Culture=neutral, PublicKeyToken=16A2C5AAAA1B130D"/>

 

If you don't do it, you will have the following error: 

The configuration section 'sourceCode.identityModel' cannot be read because it is missing a section declaration

 25850i5FF33C5355D2DF68.png

 

 

 

Note that it will be commented out in the web.config file, but it is enabled by default. To disable it, it must not be commented out and must be set to disabled, i.e. false. The errors will then cease to show.
Be the first to reply!

Reply


View our Community Site Map

Nintex Community Sitemap
Terms & ConditionsCookie settings