Subject: RE: Error using new version of OpenXDA
From: "Marks, Sean" <[email-masked]>
To: "Dunay, Doug G." <[email-masked]>
Date: Mon, 24 Jun 2024 19:17:29 +0000

Hi Doug,

Just to review.. and I’m pretty sure we don’t have any current policy settings here.

Access to this site is per the group below which is controlled by CoolCompliance.

The group has Modify access to the site in TS and Read-Only access to the site in PR.

S-OPENXDA is included in the Local Administrators group access with Full Control.

The following articles make some suggestions but are a little outside of my skill set.

I did notice two things, one is that NTLM is second is the authentication providers,

and second that Users does not have read access via the FTT web site permissions.

I checked the contents of web.config and there was not enough there to follow up on.

So, if new sections need to be added to web.config to add the Users group there the

vendor needs to provide additional instructions on the construction of the web site.

Otherwise, NTLM is listed as a provider and the path credentials appear to be correct.

For the second article, we have done some of this for the MyIED servers, historically.

We may be able to do this temporarily for web site testing with local Registry settings

but longer term a GPO might be preferred to establish these settings for all users.

Zones

The Zones key contains keys that represent each security zone that is defined for the computer.
By default, the following five zones are defined (numbered zero through four):

Value  Setting

------------------------------

0      My Computer

1      Local Intranet Zone

2      Trusted sites Zone

3      Internet Zone

4      Restricted Sites Zone

For temporary testing we would need to add the following for the S-OPENXDA user in the HKUSERS Registry hive.

Hive

HKEY_CURRENT_USER

Key path

Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\southernco.com\ts-pqdashboard

Value name

http/https

Value type

REG_DWORD

Value data

0x2 (2)

Hive

HKEY_CURRENT_USER

Key path

Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\southernco.com\ts-pqdashboard

Value name

http/https

Value type

REG_DWORD

Value data

0x2 (2)

This screenshot from SecurityWebWare shows the SID for the S-OPENXDA service account.

These screenshots show that for this user SID, there are no Domains or EscDomains defined for Http or Https

For this testing to work, we would need to create a new EscDomains folder and add the web site domain name for Http and Https.

iis 7 - Pass-through authentication not working. IIS 7 - Stack Overflow<https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fstackoverflow.com%2Fquestions%2F21540172%2Fpass-through-authentication-not-working-iis-7&data=05%7C02%7CDGDunay%40southernco.com%7C5696cc3f02e34a08e4eb08dc94824a81%7Cc0a02e2d1186410a88950a4a252ebf17%7C0%7C0%7C638548534528253898%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=ZxygntGJb%2F1yxwhK3oLYr4foU9JhP4VwfWuhJJyxc1k%3D&reserved=0>

IE security zones registry entries for advanced users - Browsers | Microsoft Learn<https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Flearn.microsoft.com%2Fen-us%2Ftroubleshoot%2Fdeveloper%2Fbrowsers%2Fsecurity-privacy%2Fie-security-zones-registry-entries&data=05%7C02%7CDGDunay%40southernco.com%7C5696cc3f02e34a08e4eb08dc94824a81%7Cc0a02e2d1186410a88950a4a252ebf17%7C0%7C0%7C638548534528265676%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=MSNK4epZmE7p08RNmxB2iSChwxyso%2Boje7yKsdJj5dI%3D&reserved=0>

Entity Name: GPC TCC Fault Data Access

From: Dunay, Doug G. <[email-masked]>
Sent: Tuesday, June 18, 2024 4:44 PM
To: Marks, Sean <[email-masked]>
Subject: RE: Error using new version of OpenXDA

Mark,

Do you have time to look at this with Grid Protection Alliance in the next week?  If you can find time, I can set up a call.

Doug

From: Credeur, Brian <[email-masked]<mailto:[email-masked]>>
Sent: Thursday, June 13, 2024 5:16 PM
To: Dunay, Doug G. <[email-masked]<mailto:[email-masked]>>; Marks, Sean <[email-masked]<mailto:[email-masked]>>
Cc: Collins, Alexis <[email-masked]<mailto:[email-masked]>>
Subject: RE: Error using new version of OpenXDA

I’m not sure on the system side.  Sean would be more knowledgeable on that front.

One thought though:  If you have the credentials for that service account you could try to login using an actual browser on that system to itself via that same URL (manually simulating what the CefSharp connection would look like).  If that works, then you’ve at least confirmed the credentials are correct.  It may not buy you much since the password hasn’t been changed recently nor is it locked out, but just a thought on something to try.

Thanks,
Brian

From: Dunay, Doug G. <[email-masked]<mailto:[email-masked]>>
Sent: Thursday, June 13, 2024 1:40 PM
To: Credeur, Brian <[email-masked]<mailto:[email-masked]>>; Marks, Sean <[email-masked]<mailto:[email-masked]>>
Cc: Collins, Alexis <[email-masked]<mailto:[email-masked]>>
Subject: Error using new version of OpenXDA

Mark and Brian,

Below is a summary of the problem we are currently experiencing trying to produce email using a new version of OpenXDA on PDXGPDH525TS.  Stephen is wonder if a group policy may be causing this condition.

Hey Doug,

Here are the details summarized from our call.

The openXDA Windows service kicks off a process that runs a headless Chromium web browser called CefSharp. This application runs as the southernco\s-openxda account and attempts to reach the https://ts-pqdashboard.southernco.com/openftt/ web page. Both the openXDA Windows service and the IIS instance are running on the same server, but the ts-pqdashboard.southernco.com domain does not appear to be trusted as an intranet site because requests to that site are prompting for credentials when they should be allowed via passthrough. Since CefSharp is a headless browser, it generally depends on passthrough authentication to work in order to authenticate. As a result, the web server responds to the request with 401.2 Unauthorized.

We tried adding the site to the intranet zone manually using Internet Options, but that doesn’t seem to have any effect on whether the website prompts for credentials. I’m wondering if there is a group policy that specifies the list of sites that are included in the intranet zone and whether we can get our site added.

I don’t remember the name of the server so you might want to add that to my summary before passing it along.

Thanks,

Stephen

Thank You,

Doug Dunay, P.E.

[email-masked]<mailto:[email-masked]>
Transmission Control Center
Office 1-470-785-1305
Cell 1-404-710-0836