auth credentials have expired

[Spencer]

Many of our users are receiving emails stating "auth credentials have expired". I assume their connection to Zimbra is timing out after x hours. Also, with others, they don't receive this message, but they stop receiving email. With a restart of Outlook this is solved.

I see the session timeout in the admin console, but I assume that is for the web interface.

Software:
Outlook 2010, 32bit.
Zimbra Enterprise 7.1.4

Thanks,

Spencer

[mattg1]

This started happening to us after upgrading the server to 7.1.4. It's driving the users crazy, as they have to restart Outlook when it happens (every 2 days, I guess).

As an attempt at minimizing the problem, I've set everyone's zimbraAuthTokenLifetime to 30 days via their COS.

The symptom is local and/or server error reports in the users' Outlook inbox when they try to sync or to send an email, and also tons of "SoapEngine - auth credentials have expired: unable to construct SOAP context" errors in mailbox.log

Prior to upgrading to 7.1.4, there were some of those errors in mailbox.log, but it was transparent to users -- i.e. somehow their auth tokens got renewed without their getting an error message.

FWIW we use Kerberos on the backend for authentication.

[Spencer]

I contacted support and they suggested the same thing and referenced this bug:

https://bugzilla.zimbra.com/show_bug.cgi?id=69536

[jwilke]

I'm running ZCS 7.1.4 and we have the exact same thing. It is VERY annoying having to restart outlook whenever this problem pops up.

[lytledd]

You'll find, that those that are complaining are the ones that are leaving Outlook running for 2 days which is the Auth token lifetime.

Doug

[jwilke]

No doubt that is true, but that doesn't relieve Zimbra of fixing this bug, as they don't decide how long someone can have outlook.exe running.

[jwilke]

So, the outlook connector generating an "auth expired" error xml report after which outlook's ability to communicate with zimbra silently dies without any sort of clear visual representation that this has happened is not a bug, and is working as intended?

It might not be a bug in the literal sense, but it is most definately bad design.

[lytledd]

Originally Posted by jwilke

No doubt that is true, but that doesn't relieve Zimbra of fixing this bug, as they don't decide how long someone can have outlook.exe running.

This will be fixed in the next release, I have an open ticket on it. The response from a Zimbra rep is:

Hello Doug,

Thanks for providing the log files requested. Looks like the issue at hand is reported also in the following bug:

https://bugzilla.zimbra.com/show_bug.cgi?id=69536.
ZCO does not prompt with re-authentication on auth_expired

The above bug is targeted to be fixed in ZCO 7.2. For now the workaround will be to restart Outlook when the issue is expired.
Also, let us know if increasing the 'Auth Token Time' also helps?

Doug

[pambuffington]

Found a 7.1.5 Pre-Release on the support page that is reported to resolve this issue. Why didn't the QA process find it?

[lytledd]

Originally Posted by pambuffington

Found a 7.1.5 Pre-Release on the support page that is reported to resolve this issue. Why didn't the QA process find it?

And after looking, I note that there is a 7.14 patch available here:

http://files2.zimbra.com/downloads/7.1.4_GA/zcs-patch-7.1.4_GA_2567.tgz

It's stated to fix the following:

Patch 7.1.4 P1 patch fixes the following bugs:
• 52190 CAC Authentication for ZWC
• 66550 GetInfoRequest RPC sometimes hangs
• 68402 TNEF parsing OOME
• 68556 Reject IMAP FETCH requests that span a large range and include BODY
• 68640 ArchiveFormatter induced deadlock
• 68786 DoS through hash table multi-collisions in Jetty
• 69132 com.zimbra.cs.mime.MimeHandlerException occurred while sending appointment invite message to the attendees
• 69155 View mail from admin console does not work for Global admin
• 69832 Forwarding multiple videos from Apple Mail app does not display from mobile device

Doug