Failed to query the OAuth S2S metadata endpoint at URI - Workflow Manager 2013
Since this is the backbone of SharePoint 2013 based workflows, I think Microsoft needs to make this application more mature and errors should be more clear and point to the root cause. Anyhow, that was just a suggestion, who cares. :)
We have came across this error while it was working fine till yesterday. We removed the bindings and when it was needed to register the workflow again, this happened.
Workflow Manager Error:
WARNING: Overwriting existing scope named "SharePoint" in the workflow server. If another SharePoint farm was
registered using this scope, that farm may not be able to continue working with the workflow server unless
re-registered under another scope name.
registered using this scope, that farm may not be able to continue working with the workflow server unless
re-registered under another scope name.
Register-SPWorkflowService : Failed to query the OAuth S2S metadata endpoint at URI
'https://mysitename.com/_layouts/15/metadata/json/1'. Error details: 'An error occurred while sending the request.'.
HTTP headers received from the server - ActivityId: 87239463-ea78-4ccc-81cd-a1ec0b903bff. NodeId: MYSERVERNAME.
Scope: /SharePoint. Client ActivityId : 9a771fa0-576d-90fb-a07e-702a7e7d916c.
At line:1 char:1
+ Register-SPWorkflowService -SPSite 'https://mysitename.com/' -Workf ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidData: (Microsoft.Share...WorkflowService:RegisterSPWorkflowService) [Register-SPW
orkflowService], InvalidRequestException
+ FullyQualifiedErrorId : Microsoft.SharePoint.WorkflowServices.PowerShell.RegisterSPWorkflowService
Farm Structure:
We have SharePoint 2019 and our farm topology is like below.
3 WFE, 2 APP, 3 WFM (dedicated servers) and of course Database cluster.
We have a web application and a dedicated URL for Workflow manager, both having DNS entries so accessible from cross server.
What we tried already?
We have tried every solution that came up on our screens however nothing helped. I must appreciate the below post for writing it in depth about the issue. We almost followed everything mentioned here. You must first check this post and see if that fixes your error. Give it a shot.
Solution that worked for me:
When nothing worked, we tried going one by one to the possibilities for this error as it says that its not able to reach and endpoint. However, still I suggested to have host entries from WFM1 server to APP1 server and from APP1 server to WFM1 server. (I am using shortcut names here, hope you will get what i mean).
After adding DNS entries, the error changed which lead me to think louder and check the other aspect. I was thinking that it could be the issue with DNS or reaching the web application, but this error says its some access denied.
Register-SPWorkflowService : A response was returned that did not come from the Workflow Manager. Status code = 401: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/> <title>401 - Unauthorized: Access is denied due to invalid credentials.</title> <style type="text/css"> <!-- body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;} fieldset{padding:0 15px 10px 15px;} h1{font-size:2.4em;margin:0;color:#FFF;} h2{font-size:1.7em;margin:0;color:#CC0000;} h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} #header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF; background-color:#555555;} #content{margin:0 0 0 2%;position:relative;} .content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;} --> </style> </head> <body> <div id="header"><h1>Server Error</h1></div> <div id="content"> <div class="content-container"><fieldset> <h2>401 - Unauthorized: Access is denied due to invalid credentials.</h2> <h3>You do not have permission to view this directory or page using the credentials that you supplied.</h3> </fieldset></div> </div> </body> </html> HTTP headers received from the server - WWW-Authenticate: Negotiate,NTLM. Client ActivityId : 83791fa0-57a4-90fb-a07e-7495396f83d9. At line:1 char:1 + Register-SPWorkflowService -SPSite 'https://mysitename.com/' -Workf ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : InvalidData: (Microsoft.Share...WorkflowService:RegisterSPWorkflowService) [Register-SPW orkflowService], AuthenticationException + FullyQualifiedErrorId : Microsoft.SharePoint.WorkflowServices.PowerShell.RegisterSPWorkflowService
Till now I knew that our environment is properly set for permissions however this was something strange. Followed below steps to resolve the issue.
1. We granted DB Owner and Security Admin permissions to Workflow Manager service account on the SharePoint Config database.
2. Removed the Workflow Manager Proxy service and registered workflow again.
3. Now you can revoke the permissions again since the workflow has been registered successfully.
It worked like a charm, hope it will help someone.
Comments
Post a Comment