Saturday, October 6, 2012

Problems with upgrading claims based site from Sharepoint 2010 to Sharepoint 2013 Preview

Recently we upgraded several sites which were implemented for Sharepoint 2010 to Sharepoint 2013 Preview. Upgrade was done according to MS guides. Existing SP2010 sites use claims based authentication. So we made backup of existing content database from SP2010 farm, copied them to SP2013 farm and restored on database server. After that we created web applications on SP2013 farm also using claims based authentication (we created them from UI and as you probably know in SP2013 claims based authentication is the only option when you create web application from Central administration. If you want to create web application with classic Windows authentication you have to use PowerShell).

After that we used Test-SPContentDatabase cmdlet in order to check restored SP2010 content database against SP2013 web application (at that moment SP2010 database was not mounted yet to SP2013 web application. The last one used its own content database which was created with web application). Test-SPContentDatabase gives several messages about missing assemblies which was Ok because custom wsp packages were not deployed to SP2013 farm yet. The most interesting was the last message:

Category Configuration
Error False
UpgradeBlocking False
Message

The [web_app_name] web application is configured with claims authentication mode however the content database you are trying to attach is intended to be used against a windows classic authentication mode.

Remedy

There is an inconsistency between the authentication mode of target web application and the source web application. Ensure that the authentication mode setting in upgraded web application is the same as what you had in previous SharePoint 2010 web application. Refer to the link "http://go.microsoft.com/fwlink/?LinkId=236865" for more information.

Locations  

So it says that target web app on SP2013 farm is configured to use claims based authentication, but source content database from SP2010 supposed to be used with classic Windows authentication. It is not correct, because as I said migrated SP2010 web sites use claims based authentication as well.

Ok, but as you can see UpgradeBlocking property was false for this message, we ignored this message and mounted content database to the web application using Mount-SPContentDatabase cmdlet. As you probably know this command also performs actual upgrade of content database schema from SP2010 to SP2013. Command ran successfully, but number of site collections for mounted content database was shown as 0 (while actually there should be 1 site collection) and site didn’t work.

After that I thought that if it says that content database should be used with classic Windows authentication, we should try to create such web application in SP2013 farm and run Test-SPContentDatabase again. So we created web application with classic Windows authentication using PowerShell, restored SP2010 content database again (it was upgraded to SP2013 schema during previous run of Mount-SPContentDatabase cmdlet) and ran Test-SPContentDatabase. Now it showed opposite error:

Category Configuration
Error False
UpgradeBlocking False
Message

The [web_app_name] web application is configured with windows classic authentication mode however the content database you are trying to attach is intended to be used against a claims authentication mode.

Remedy

There is an inconsistency between the authentication mode of target web application and the source web application. Ensure that the authentication mode setting in upgraded web application is the same as what you had in previous SharePoint 2010 web application. Refer to the link "http://go.microsoft.com/fwlink/?LinkId=236865" for more information.

Locations  

This message is actually correct, but the fact that it is opposite to the message which we got for the same database first time makes me think that this is a bug in Test-SPContentDatabase.

We ignored this message again and ran Mount-SPContentDatabase for claims based database from SP2010 farm and Windows classic authentication web application from SP2013 farm. This time number of site collections was set to 1 which was correct. But web application used Windows classic mode, so the last step was migrating it to use claims based authentication as described in the article which link was in the messages shown above: Migrate from classic-mode to claims-based authentication. After that upgraded sites were opened successfully. This is so-called hybrid mode when sites work in SP2010 mode on SP2013 farm (for this purpose folder “14” is included into SP2013 installation).

This is how we performed upgrade of claims based authentication sites from SP2010 to SP2013. It may be so that these problems are caused by Preview version of Sharepoint 2013. If you will face with similar problems in would be great if you will share them in comments here.

6 comments:

  1. I am facing exactly same error however i am using Full version of Sharepoint 2013 . Also the Sp 2010 datbase is post sp1. Any update ???

    Thanks

    ReplyDelete
  2. Manjiri Patil,
    did you try solution, which I described above? Using it we were able to finish migration.

    ReplyDelete
  3. Hi, I am facing exactly the same problem. Although I have the error message, everything works correctly with the new interface, etc.. Although it is not affecting me in any way, I would like not to have that message.

    ReplyDelete
  4. I am getting Access denied even after adding portalusera ccount as well as disable loopback check.

    This is what i tried
    •New-SPWebApplication -Name "Spdev2013Test" -ApplicationPool "spdev2013TestAppPool" -AuthenticationMethod "NTLM" -ApplicationPoolAccount(Get-SPManagedAccount "contoso\spfarm") -DatabaseName "Wss_Content_spdev2013tmp" -Port 443 -URL https://sp2013.contoso.com -SecureSocketsLayer
    •Test-SPContentDatabase -Name WSS_Content_restore -WebApplication https://sp2013.contoso.com
    •Mount-SPContentDatabase -Name WSS_Content_restore -WebApplication https://sp2013.contoso.com
    •Convert-SPWebApplication -Identity "https://sp2013.contoso.com " -To Claims -RetainPermissions -Force
    •$wa = Get-SPWebApplication "https://sp2013.contoso.com"
    $wa.MigrateUsers($true)
    $wa.Properties["portalsuperuseraccount"] = "i:0#.w|contoso\spfarm"
    $wa.Properties["portalsuperreaderaccount"] = "i:0#.w|contoso\spfarm"
    $wa.Update()
    iisreset /noforce

    Any idea???

    ReplyDelete
  5. Manjiri Patil,
    you use ntlm authentication, but add user accounts in claims format. Try to add them in ntlm format.

    ReplyDelete
  6. But i am converting the webapp to Claims using
    Convert-SPWebApplication -Identity "https://sp2013.contoso.com " -To Claims -RetainPermissions -Force

    Right ??? i think i may not need to do $wa.MigrateUsers($true) once i did convert but not sure ???

    ReplyDelete