Send Email Functionality not working after portal upgrade from version 4 to 7.4

Suruchi_Bharati

we upgraded cireson portal production from version 4 to version 7.4 . After the upgrade- the send email functionality is not working. Prior to the upgrade it was working with the same settings. I see the below error in the log:

Send Email Failed:The SMTP server requires a secure connection or the client was not authenticated. The server response was: 5.7.1 Client was not authenticated

This is production - we require urgent assistance. kindly suggest! Thanks

Brian_Wiest

Double check your SMTP settings in the Admin pane
Click username - Admin settings
Settings Items
SMTPServerName
SMTPServer Port

Then on that server name and port it must accept anonymous relays.

Suruchi_Bharati

Thanks Brian, These settings are unchanged after the upgrade. I have checked all of them.

Brian_Wiest

The error message is that your Exchange entry point is not allowing anonymous relays. you will want to verify the admins also did not make changes.

Suruchi_Bharati

We are checking with our exchange admin. thanks

Konstantin_Slavin-Bo

Yeah, the issue is definitely with sending anonymously through SMTP. Did you migrate from on-prem Exchange to Exchange Online at the same time by any chance? Exchange Online does not support Windows Authentication (which is what the SCSM notification channel is using), so you will need a local SMTP relay, through which you can send notifications from SCSM.

Suruchi_Bharati

is there something we can do at cireson/Service manager end ? Still awaiting response from exchange admin...

Brian_Wiest

The Service Manager Exchange connectors can be setup from Authenticated connections. However the portal Send Email task uses the settings in the admin panel which as of the current version 7.4.x.11 still only allows anonymous relay connections.

Konstantin_Slavin-Bo

If you have migrated to Exchange Online ("Office 365") then unfortunately not. As stated in my last post, Exchange Online does not support Windows Authentication, and that is the only authentication SCSM supports (apart from anonymous), as far as I know. You will need a local SMTP relay. 

Suruchi_Bharati

which specific server should be added to smtp relay ?cireson Portal server ?

Brian_Wiest

That is dependent on your environment. It is whatever your exchange SMTP relay server or url is. 

Suruchi_Bharati

exchange team is asking - What is the name of the sending server/ip? This is the cireson portal server correct?

Brian_Wiest

Yes

Suruchi_Bharati

Exchange admin says this server is already in the relay. nothing has changed - it seems something in upgrade process changed something on cireson end that has impacted this

Suruchi_Bharati

does the exchange return address need any special permissions on cireson or service manager side - any groups he should be part of that might have changed due to upgrade ?

Brian_Wiest

The upgrade did not change anything with the SMTP send email function. 
Its all dependent on your exchange admin seeing the logs for what is hitting their SMTP relay entry point.

Joe_Burrows

Hi Suruchi

If you are using exchange make sure the CiresonPortal IIS App-pool account has Send As permission to the mailbox you have configured as the FROM address.

Cheers
Joe

Jonathan_Boles

Good Day everyone, we've seen the exact same issue when migrating to v7.4.2012.9. Not sure what exactly the cause is but is most certainly something caused by the upgrade and not an external factor. This has been tested by using a third party SMTP (MailDev) as well as testing with the exact same account using another environment on v4.0.10.

@Suruchi_Bharati, I would suggest putting through a support ticket for more assistance. While I in most circumstances would be saying the exact same thing as @Brian_Wiest and @Konstantin_Slavin-Bo I can attest that this occurred in multiple environments and have found to be repeatable when moving from v4.0.10 (and possibly other 4.x releases) to v7.4.2012.9.

If someone else in the community has any ideas to fix this, I would love to be proven wrong but after spending hours investigating this and testing with other environments, I'm thinking it's got to be something else. I wanted to post several weeks ago when I came across the issue but didn't as I figured I must be loosing it so it's good to see someone else stepped up reporting the issue.

Joe_Burrows

Jonathan_Boles said:

Good Day everyone, we've seen the exact same issue when migrating to v7.4.2012.9. Not sure what exactly the cause is but is most certainly something caused by the upgrade and not an external factor. This has been tested by using a third party SMTP (MailDev) as well as testing with the exact same account using another environment on v4.0.10.

@Suruchi_Bharati, I would suggest putting through a support ticket for more assistance. While I in most circumstances would be saying the exact same thing as @Brian_Wiest and @Konstantin_Slavin-Bo I can attest that this occurred in multiple environments and have found to be repeatable when moving from v4.0.10 (and possibly other 4.x releases) to v7.4.2012.9.

If someone else in the community has any ideas to fix this, I would love to be proven wrong but after spending hours investigating this and testing with other environments, I'm thinking it's got to be something else. I wanted to post several weeks ago when I came across the issue but didn't as I figured I must be loosing it so it's good to see someone else stepped up reporting the issue.

@Jonathan_Boles

The task was changed to use default credentials to relay (App-Pool Account). The account will need permission to send as the mailbox used as the FROM address to be relayed.

Hope that helps, if still an issue after granted SEND AS permissions let me know.

Regards
Joe

Jonathan_Boles

Thanks @Joe_Burrows! I'll take note of this when we elevate our QA environments for IT here in the coming days and give this fix a shot and report back with the results! @Suruchi_Bharati, looks like this might do the trick!

Suruchi_Bharati

Thank you Joe and Jonathan. I would like to try this fix. So essentially we need to create a mailbox account for the app pool service account and grant it send as permissions. Is that correct? Kindly confirm so I can try - this is causing much user issues in our Production

Joe_Burrows

You shouldnt need to create a mailbox, rather grant the app-pool service account Send As permission to which ever mailbox you are using as the from address.

Example: I need to grant CiresonPortalsvc send as permissions to the support mailbox Support@Cireson.com if using an exchange server for SMTP relay.

Suruchi_Bharati

So we are using svc_scsm_exchangeconn as the From account, I granted this Send as permission to our app pool account - svc)scsm_services.  That didn't work,  Does the website need to be restarted ? Am I missing something.

Joe_Burrows

You need to Grant scsm_services send as permission to svc_scsm_exchangeconn (Sounds like you have done it the wrong way around)

Suruchi_Bharati

We have no mailbox for scsm_services account , its just a service account. So looks like I need create a mailbox for it first and then grant the requisite permissions?

Konstantin_Slavin-Bo

svc-scsm_services is the service account for the Cireson AppPool, yes? 

If yes, the svc-scsm_services account does not need a mailbox. It needs to have send as permissions on the svc_scsm_exchangeconn mailbox, so it can send mails from that mailbox. 

Suruchi_Bharati

So - on the exchange console - in recipient configuration - in mailbox - for svc_scsm_exchangeconn account - i click manage send as permissions and added svc_scsm_services to that list.  screenshot attached, this is still not working

Suruchi_Bharati

screenshot of manage send as permissions attached

Suruchi_Bharati

Jonathan please advise  if this is planned to be addressed in near future or will it continue as-is. Does cireson plan to revert it to use the account specified in the admin setting in the portal. Thanks.

Suruchi_Bharati

Konstantin_Slavin-Bo : Yes svc-scsm_services is the service account for the Cireson AppPool. It has already been granted send as permissions on the svc_scsm_exchangeconn account.

Brian_Wiest

Has your exchange team run a trace on the SMTP relay to see the message arriving and the rejection reason?
Thru this has the message to wrote at the top of the chain changed?
The original error is reporting that the SMTP relay requires authentication, can the exchange team white list your server IP for anonymous relay?