• ADO.NET Data Services Update for .NET Framework 3.5 SP1 for Windows 2000, Windows Server 2003, Windows XP, Windows Vista and Windows Server 2008
• ADO.NET Data Services Update for .NET Framework 3.5 SP1 for Windows 7 and Windows Server 2008 R2

So after doing this multiple times, I proceeded to do my usual atom feed import like I usually do:

Repro the issue

1) Go to my SharePoint List and click on Export as Data Feed

2)  When requested to do a File Download of the List.atomsvc file, click Open

3) Because you installed PowerPivot on your box, it will give you the option to import this Atom feed into an existing (e.g. Book1) or new workbook.  Choose appropriately and click OK.

4) It’ll provide you the Table Import Wizard so you can import your feed

5) Everything works like usual in terms of a PowerPivot data import

.

What did I expect?

6) But instead of the nice message indicating that you had imported data properly:

so it shows up nicely in your PowerPivot workbook

.

What did I actually get?

7) you get this strange error message:

in text this is:

For security reasons DTD is prohibited in this XML document.  To enable DTD processing set the ProhibitDtd property on XmlReaderSettings to false and pass the settings into XmlReader.Create method.

So how do I FIX this?

Thanks to John McConnell for reminding me that sometimes the solution is to do something simple (for context, I just had published the PowerPivot Security Architecture so my brain is still fried).

So the solution is to simply re-install ADO.NET Data Services Update for .NET Framework 3.5 SP1 again.  Yup, rather long bit of writing to simply say – install it again!

But there you have it

Heads up, this posting’s title was “User credentials could not be delegated and Active Directory” but I realized I needed a title that evoked my emotional state 

Do not fret or worry, this is not “yet another user credentials delegation” blog. After all, there are already the postings including Troubleshooting #PowerPivot Excel Services connectivity (written by yours truly) and Excel Services delegation (by PowerPivotTwins partner Dave Wickert).

 

More importantly, if you want to debug and troubleshoot your way through the PowerPivot / Excel Services delegation issues, the coup-de-grace is Lee Graber’s excellent post: that The data connection uses Windows Authentication and user credentials could not be delegated. 

  And don’t forget Dave Wickert’s Help: c2wts has fallen and it cannot get up which contains a great tip about crypto service. 

.

But interestingly enough, Ayad Shammout (Database/IT Pro extraordinare from CareGroup Healthcare, he’s also pinged in the recent eWeek article: Execs Take BI into Their Own Hands) and I had ran into a rather hinke issue concerning user credentials delegation in a PowerPivot for SharePoint environment.  We had followed the above blogs and still could not resolve the problem. 

In Ayad’s PROD environment, clicking on the slicers on a PowerPivot workbook within PowerPivot for SharePoint would only work if you were a domain administrator.  If you were a regular domain account, you would get the error “The data connection uses Windows Authentication and user credentials could not be delegated”.  But in the DEV environment, everything worked normally.

By following Lee’s posting The data connection uses Windows Authentication and user credentials could not be delegated, we carried out the steps within How To: Request a Token from C2WTS and was better able to map out which AD accounts were able (and were not able) to map a claims token back to a windows identity.  What we had discovered was that for the AD accounts within PROD that were able to have their user credentials delegated were had the additional permissions of:

• Were members of the “Pre-Windows 2000” NT group (i.e. have Pre-Windows 2000 Compatible Access”
• Were part of the “Authenticated Users” group and had “Read Permissions”

Once we added the above permissions to the regular AD domain accounts, now they no longer had problems having their user credentials delegated (i.e. could click on slicers in PowerPivot workbooks within SharePoint). 

But there was still something interesting…if we go back and look at the DEV domain, none of the domain users required the above permissions yet they were able to have their user credentials delegated without any issues.   Further analysis by Ayad came to the realization that the DEV domain was a newly minted domain built on top of Windows 2003.  But, the PROD domain was a domain that was originally built on top of NT 4.0 and migrated to NT 4.0 SP3, Windows 2003.  (Note, both will be upgraded to Windows 2008 R2 in the near future).  And in NT 4.0, there was no such concept as the “Authenticated Users” group – this was introduced in NT 4.0 SP3.

So the lesson learned here as well is that if you have an upgraded active directory, you may run into issues like failure to delegate user credentials within SharePoint unless those domain accounts are included in the “Pre-Windows 2000” group and the “Authenticated Users” group (with Read Permissions).

Whew!

Many thanks also go out to Meghann Wilkinson Poku, Jason Fournerat, Corey Myers, Dave Wickert, and Lee Graber for helping Ayad and I solve this problem!

But it’s not like I haven’t been tweeting about PowerPivot…thank goodness I can easily retweet or type 140 characters! (follow me @dennylee)

But I do have a good excuse!  Really!

Oh, and for those of you patient enough to read to the end, I do have an interesting sneak peek for you

RTM… aaaaaaahhhhhh!!

RTM is driving me nuts…but then again, Dave Wickert (PowerPivotGeek) has been handling this like a champ (he’s got some great postings on his site: PowerPivotGeek.com, eh?!).  His and my postings are re-posted on PowerPivotTwins.com – the PowerPivotTwins in one place – yay!

Some great ones that you really need to review include:

• A Peek Inside: Allocation. What is it? Why is it important?: This is a really important post because it talks about why you should use the health-based load balancing allocation method.  If you plan to have a lot of users on your PowerPivot for SharePoint environment involving multiple servers – read this posting!
• PowerPivot Component Architecture: As noted in the blog post, this is an excerpt from “Microsoft SQL Server PowerPivot Planning and Deployment” whitepaper will be coming out shortly.  Once its published, we’ll point to it from this blog post, SQLCAT.com, PowerPivot blog, etc.  But if you want to understand all of the components within PowerPivot – from Excel Services to the OLE DB Provider for Analysis Services to PowerPivot System Service – here’s the sneak peek, eh?!
• Help: c2wts has fallen and it cannot get up: As noted in the above PowerPivot Component architecture, in order to facilitate communication from PowerPivot System Service to the Analysis Services Engine in VertiPaq mode, we need the Claims to Windows Token Service up and running.  Sometimes c2wts starts up slowly (if its not running, then you will get an Excel Services delegation error); this great post from Dave provides some tips on how to get c2wts working faster.

Writing, Writing, … and Writing

Fair enough, this is just a blatant self promotion here, but I’ve been working nights and weekends with my Analysis Services compatriots Siva Harinath and Ron Pihlgren on our upcoming book: Professional Business Intelligence with PowerPivot for Microsoft Office 2010

Why not pre-order this book and make my publisher happy .    But seriously, we hope this book provides you a great end-to-end picture of PowerPivot, eh?!

Can I blame it on the Apple iPad?

Yes, just like the NY Times, I’ve been drooling over this device over the last month or so.  Perhaps my mind was entranced over the large screen and just how dang cool it looks.  Alas, as amazing as it is – it couldn’t hold me over for a month – geez!  Actually, if you follow me via Twitter or Facebook at all, you’ll probably notice the tweet:

Don’t say I don’t love the game of ultimate frisbee, I chose going to gnarly nines tourney in JeJu (South Korea) over an Apple iPad!

In reality, that’s what’s been driving me nuts – the fact that I had to choose between an ultimate tournament or an Apple iPad…and amazingly, I chose the former.

And here I am in all my (fat) glory hucking a disc – because dang it, I love the game of ultimate.  Enough that the Gnarly Nines tourney in Jeju is holding sway over me even though I’m old, fat, cannot run, frankly untalented….yeah, that just about covers it!

Nah…it was TechReady 10!

Ahh…but for all of you that follow me on FourSquare, perhaps its a different story.  From there, you’ll realize that one of the Microsoft employee conferences we have each year is called TechReady (similar to TechEd – which is New Orleans in June this year) except for employees only and always in Seattle (whew, less flying).

And with all of the Analysis Service AND PowerPivot stuff that we were talking about – that just frankly took the cake and wore me out. 

Well, that’s the sneak peek in store.  If you are fans of the SharePoint Technical diagrams (poster diagrams providing excellent view of SharePoint), well over the next few months – we will be releasing PowerPivot Technical diagrams as well!  I figured I’d jump the punch because there were some postings and questions fielded after TechReady, eh?! 

To infinity…and beyond!

So things are starting to get more normal for me and I’ll start blogging again with all sorts of cool PowerPivot and Analysis Services stuff, eh?!  And as soon as the first of the many PowerPivot Technical Diagrams is ready for your review, we’ll publish them and blog / tweet crazy, eh?!

Enjoy!

Figure 1: Click the checkbox to enable client tracing

In order to view this trace, you will use SQL Server Profiler to view it.  Yet, if you do not have a SQL Server 2008 R2 client components installed on your box, you will get the following error:

Figure 2: SQL Server Profiler cannot open the trace

The error message says:

Unable to location trace definition file Microsoft Analysis Services TraceDefinition 10.50.0.xml for open trace file …

In many cases, you will not since your business analysts are using Excel as their primary tool.  If they have SQL Server client components installed, commonly it is the SQL Server 2008 components as opposed to the SQL Server 2008 R2 components.

So how can your SQL Server 2008 Profiler read this trace so that way you do not have to uninstall / install the SQL Server 2008 R2 client components?  You have two options:

1. Connect your SQL Server 2008 Profiler to a SQL Server 2008 R2 Analysis Services server.  The profiler caches these tracedefinition files within the \Program Files (x86)\Microsoft SQL Server\100\Tools\Profiler\Tracedefinitions folder.  So when you connect to a SQL Server 2008 R2 Analysis Services server, the profiler will obtain from the server the trace definition of that server if it does not already have it.
2. Copy the trace definition file to your profiler directory.  Since the trace definitions are located in the \Program Files (x86)\Microsoft SQL Server\100\Tools\Profiler\TraceDefinitions, just go to this folder onto a server that has R2 running on it.  Copy the Microsoft Analysis Services TraceDefinition 10.50.0 file to your own box.

Thanks to Mike Vovchik from the Analysis Services team for helping me solve the problem as well.

Enjoy!

Enjoy!

To perform an Excel “Save As”, you need only to click on “Save As” within the File option of the Office Ribbon and specify the PowerPivot Gallery of your SharePoint site.

Figure 1: Excel “Save As” functionality

When you do, you’ll notice the Office Upload Center icon pop up in the notification area.

Figure 2: Microsoft Office Upload Center within the Notification area

If you open the Office Upload Center, it will provide a dialog of all of the files that it has pending upload or recently uploaded.

Figure 3: List of files being uploaded (notice Pending Uploads) to the SharePoint site.

When it works great, well, it works great!  In order for the Office Upload Center to perform its tasks, it will create a copy of the file in its cache and then upload the cached version of the file to SharePoint (hence allowing you to work with the original file in the meantime).   Notice how on Figure 4 that there is a large file that is curiously the same size as my original Excel file.

Figure 4: Office Upload Center Cache location

There are times where there are errors with the upload with the Office Upload Center.  If they do, they should show up in the Pending Uploads section of the Office Upload Center.   From here, you click on “Actions” (notice the Actions button in Figure 3) which should allow you to delete it.

If for some reason you cannot delete it, then what you can do is:

1. Kill the Office Upload Center process within task manager (MSOSYNC.exe)
2. Go to the C:\Users\<user>\AppData\Local\Microsoft\Office\14.0 location.  Often if there are issue with uploading through this method, you can delete the files in this directory.You may also want to delete the files in the
   1. C:\Users\<user>\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO
   2. C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\TfsStore\Tfs_DAV

Ensure that you have the original files still stored somewhere else before deleting these files but this should clear out the cache and you can then re-start the upload all over again.

For Quick Tips for clearing up space #PowerPivot for SharePoint Uploading, please refer to the linked blog posting.  Note that the reason a PowerPivot for Excel workbook may fail to upload via the SharePoint UI is that you’ll need to clear out the files within SharePoint (as per the blog posting).

Enjoy!