You are viewing limited content. For full access, please sign in.

Question

Question

LicenseManagerWCF/localhost - STSEndpointUtility

asked on February 7, 2023

Why does the STSEndpointUtility on my production LFDS server have LicenseManagerWCF/localhost as the Service user's principal Name?

 


 

I found this reference to that account in the release notes for Laserfiche 11:


During the installation process when upgrading from Directory Server 10.0 to 10.3, the initial loading of the STS Endpoint Utility (STSEndpointUtility.exe) may show the service user as  "LicenseManagerWCF/localhost." Reopen the utility to verify that the value is correct. (63505)

 

We have been on version Laserfiche 11 for a while so the above doesn't really seem to apply to us and reopening the utility doesn't change the value.

I found this in the documentation:

https://doc.laserfiche.com/laserfiche.documentation/11/administration/en-us/Subsystems/LFDS/Content/InitialConfiguration.htm

Note: The user principal name must match the service user. If you change the service user, you must re-run the utility to update the user principal name for the endpoint. If there is a mismatch between the service user and the endpoint binding information, you may receive a "The caller was not authenticated by the service" error message.

I only noticed this when trying to troubleshoot an issue involving the LFDS sign-ons via the Web Client. I don't see any 'caller was not authenticated by the service' error message. We are getting an 'invalid connection' error message in the event logs for the Web Client server but that seems to be fairly generic. And I don't know how long it's been set this way. It's possible it's been like this for a while and the problem with the Web Client server just started up.

But I'm not asking anyone to dive into that with me at the moment. I just want to know if the above is a problem somehow, related to the one I'm having with Web Client or not. Should I try to change the name to the one running the service?

0 0

Replies

replied on February 8, 2023

While I can't speak to why it's showing that, I can confirm that you should definitely change the value shown there in the Service User Principal Name field.

If the Laserfiche Directory Server service is running under a system account, you can simply type that with no spaces (i.e. LocalSystem, NetworkService, etc.). If it's running under a domain service account, place that there with the domain specified (i.e. serviceaccount@domain.com). 

Having an incorrect or invalid value for the UPN will cause issues. You can open the LFDSSTS Config page to see if errors are shown:

https://localhost/LFDSSTS/Configuration 

0 0
You are not allowed to follow up in this post.

Sign in to reply to this post.