Cascade Skyline - with Microsoft Logo and Project Support header - author Brian Smith

Project Server 2007: WSS Sync issues – Error: Access Denied

Project Server 2007: WSS Sync issues – Error: Access Denied

  • Comments 17

After the notorious check-in pending, and the slow cube building issues, the next hot topic has to be problems around WSS Synchronization.  This was noted in one of the recent TechNet updates (I’ve also just corrected the link in my previous posting – sorry) for Active Directory synchronization, but AD Sync is just one of the scenarios leading to this issue.  In case you are not familiar with this one, basically there are two parts to the story:

  • Sync of permissions for sites (including /PWA) can be really slow if you have lots of users
  • If more than one sync is in progress then SQL deadlocks are likely to occur

For our larger customers the first item is bad enough, but generally if the sync is slow there is a greater risk of another sync clashing.  These synchronizations can be a result of changes in group security settings, syncs to AD or just re-sync’ing the site permissions for the workspaces.  They are also more likely if your category settings mean that virtually all users can access all projects – more permissions to sync!

The typical symptoms for users is that they can be left out in the cold with an Error: Access Denied – with the option to sign in as a different user.  Behind the scenes, in the queue and the ULS logs you will see such things as:

Manage Queue page

"User Synchronization for Project Web Access App Root Site and Project WSS Workspace" fail with the Job State error of "Failed But Not Blocking Correlation"

ULS Logs

10/06/2008 17:11:37.16  Microsoft.Office.Project.Server (0x07D8) 0x0CF0 Windows SharePoint Services    Database                       6f8g Unexpected Unexpected query execution failure, error code 1205. Additional error information from SQL Server is included below. "Transaction (Process ID 98) was deadlocked on lock resources with another process and has been chosen as the deadlock victim. Rerun the transaction." Query text (if available): "{?=call proc_SecAddPrincipalToRole(?,?,?,?,?,?)}"

The updated part of the TechNet article is worth repeating here, as it gives some suggestions for reducing the occurrence of the problem, and links to some tools which you may find useful, so here it is:

Caution Caution:

Under certain circumstances, synchronizing Project Server users and workspaces with Active Directory can cause a “deadlock” situation in which all users are locked out of a PWA site or the respective workspaces. This causes user synchronization jobs to fail and site permissions to synchronize partially or not at all. Users may not be able to log on to PWA or their workspaces.

A deadlock can occur if the user synchronization process is taking too long to complete. This is due to the synchronization job iterating through many users and workspaces, for example, when large membership changes are being made. A synchronization job remaining in the queue a long time increases the possibility of other jobs starting inadvertently, which can also cause a deadlock.

To reduce the chance of a deadlock, you can do the following:

  • Before making large group membership changes, verify that there are no jobs named “User Synchronization for Project Web Access App Root Site and Project WSS Workspaces” currently processing or waiting to be processed in the queue.

  • Run the Project Server Workspace Sync tool on the CodePlex site (http://go.microsoft.com/fwlink/?LinkId=147394). The tool controls what is to be synchronized when the job starts — PWA and workspaces, workspaces only, PWA only, or no synchronization for either PWA or workspaces — and allows the administrator to perform the user synchronization during non-working or off-peak hours when server overhead is lower.

    Note that the Project Server Workspace Sync tool does not speed up the synchronization process beyond normal. However, being able to synchronize users when server overhead is lower reduces the possibility of synchronization failures.

Unfortunately there isn’t a fix coming for this one any time soon – it is harder to do than you might think, with so many moving parts.  I hope this at least helps you to work around the issues and sorry for the undoubted inconvenience this one has been causing.

 

Technorati Tags: ,

Leave a Comment
  • Please add 4 and 8 and type the answer here:
  • Post
  • Hi Brain,

     Can you suggest any point to start debugging project server 2007 as one of my user complained that he has created an issue on his project workspace at 11:23 am today whereas, project server shows him 10:23 am. I have check the queue and nothing found intresting neither in log file. I have applied all latest patches including SP2 and WSS 3.0 along with April Cumulative update.

     I don't know either I am right or wrong, but my mind still stuck up at a point that we have change our server time last month and this problem occur just because of that. But no other project manager complained about this issue or either they have failed to notice such abnormal behaviour and if you remember about my last issue of deleting timesheet line causing an error and it also occur after changing the server time.

    Can you kindly suggest anything that helps me out in starting up the analysis.

    Regards,

    Hyder Zaidi

  • Any words on when this issue will be addressed by a hot fix or SP, this is happening too often for us.

  • Hi Brian

    What if im already in the situation ? and i have a 50% completion status .. should i cancel the job and start allover again?

  • Brian,

    Your posting states that the tool allows you to choose between workpaces or pwa or both. But description of the tool does not explain how to use it for pwa only.

  • Brian,

    I think I did ask this previously but perhaps I did not submit.

    The tool does not syncrhonize permissions for PWA ONLY?  How do we do this?

    Secondly, I am quite dissapointed to see the very little amount of attention that this is recieving from your guys.  This is affeting almost every big customer I have, and the amount of communication coming out from MS on how we should deal with this is positively shocking.

    Please can you help us deal with this problem more effectively?

    thanks,

    Nico Oosthuysen

  • While creating the new user, this time only i facing this issue.

    Error summary/areas:

    Queue

    GeneralQueueJobFailed

    Error details:

    <?xml version="1.0" encoding="utf-16"?>

    <errinfo>

     <general>

       <class name="Queue">

         <error id="26000" name="GeneralQueueJobFailed" uid="00fca5ed-6d4b-41bc-ba4b-bb7a3a28d997" JobUID="88ebded9-97ae-4f8e-b0aa-e30282dfd2ca" ComputerName="DCA-APP-78" GroupType="SynchronizeSingleUserMembershipInWss" MessageType="SynchronizeSingleUserMembershipInWssMessage2" MessageId="2" Stage="" />

       </class>

     </general>

    </errinfo>

    could you please revert with u r input.

  • Hi Brian,

    Thank you for posting the User Sync problem.  What is the actual solution when the User Sycn/Access Denied issue occurs. We're experiencing this Access Denied issue now for some PWA users after we made added a category to our PM group.  The only solution we've found is to visit each individuals account and force the User Sync job to run by making a change.  Afterwards the User Sycn job completes successfully the user can then access PWA again.

  • Hi David, the solution is to implement the workaround described above to stop the problem recurring during work hours. No fix currently.

    Best regards,

    Brian

  • What exactly is the workaround, Brian?  The job fails all of the time whether during the day or on off hours.  There is no information about this anywhere.  The workspace sync tool doesn't work as you described.  How can you get it sync only pwa?  Why isn't this being answered?  Why is Microsoft trying to sell this as a large-scale enterprise solution when it most definitely is not?

  • Hi Scot,

    We do have very many large scale enterprises using this workaround to manage their WSS synchronization.  If you are having problems then perhaps your issue is something else, and you should open a support incident to allow us to assist you.  We have done a great deal to address this in the next release (available in Beta now) but it isn't something we could adequatly address in 2007

    Best regards,

    Brian

  • Hey Brian,

    we now have the same issue and I`m working currently in a large-scale enterprise project.

    And we`re facing the same problem but the main problem is that as well after the AD ERP Sync @3AM and the AD Group Sync @4AM where in the night this happens. And you can bet on that we have strong servers...

    1.

    Ok so you said that currently there will be no fix in the CUs. So the workaround is to use this workspace sync tool.

    First of all there`s really no option to use PWA Only. The function itself will never be used in the code to sync the PWA.

    But ok I will write a scheduled task to run that function standalone.

    2.

    We have to accept at the current situation that sql deadlocks happen when this job is executed and to get "failed but not blocking ..." error in the queue.

    But so far it`s not a problem, cause when you run the job again and the job suceeds everything fine again.. Is that right ?

    3.

    Like to have proposal:

    Currently you can only deactivate the synchronization for project workspaces, which we did. This works for the workspaces and we were able customize the synchronization with the project workspaces the way we need it.

    For the "User Synchronization for Project Web Access App Root Site and Project WSS Workspace"

    there should be as well a job to directly deactivate the synchronization between Project Web Access (Sharepoint) Permissions and projectserver. I`m pretty sure this would be not too hard for your developers to make it available as checkbox in the server settings.

    Then it would make sense to write an own multithreaded :) synchronization between the site permissions and the project server and to avoid deadlocks.

    Let me know what you think of it.

    Greetz from Germany,

    Flo

  • Hi Flo,

    Sorry for the delay in responding - deep in 2010 stuff.  The best option here would be to log this as a support incident and work through this with a support engineer.  I do appreciate this sounds an easy thing to just ad a checkbox - but with all the behind the scenes stuff and localization requirements it isn't a quick or easy option.

    Best regards,

    Brian.

  • The same problem still exist in Project Server 2010, this issue is not adressed !!!

  • Hi liridon,

    There are a number of changes in 2010 that should mitigate this issue - but it can still happen for very brief periods.  if you are seeing otherwise then best log a support incident as it may be a different issue.

    Best regards,

    Brian.

  • iam working in MSP 2007. I have a problem with MSP 2007 i.e when iam trying to save my plan it is showing out of syncronised error. If i click yes i lost my data under actual work column.

    Can any one help me this issue.

Page 1 of 2 (17 items) 12