403.16 error : “Root certificate which is not trusted by the trust provider. (0x800b0109)”

by Contributed | Jun 16, 2021 | Technology

This article is contributed. See the original author and article here.

A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider. (0x800b0109)

Client Certificate is a digital certificate which confirms to the X.509 system. It is used by client machines/users to prove their identity to the remote server.

We normally get 403 errors if the client certificate authentication is not configured properly. In this article, we will talk about the error “403 – Access denied” while browsing a site hosted on IIS (internet information services).

“403 – Access denied” might be a custom error message thrown from the application code. Hence, we need to get the exact status code and sub-status code from the IIS logs stored in the location C:inetpublogsLogFilesW3SVC{site_id}

In this scenario, IIS logs had the error code 403.16.

HTTP 403.16 indicates that the Client certificate is untrusted or invalid : If IIS is not configured to use a CTL, SSL client certificate authentication will fail with the 403.16 error condition. This error occurs because SChannel.dll wrongly considers the client certificate to be untrusted

As a troubleshooting step, we can enable CAPI2 logging to get more details on 403.16 error. Below are the steps to enable it.

• In the Event Viewer, go to Application and Services Logs -> Microsoft -> Windows -> CAPI 2 to get the CAPI 2 channel.


• Right-click on “Operational” and select “Enable Log”. This will enable CAPI2 Diagnostics logging.

CAPI2 logging has generated below event log for 403.16 error.

Above highlighted error message would occur when there is a non-self-signed certificate present in Trusted root Certification authorities certificate store on the MMC console. We can resolve 403.16 error by removing the non-self-signed certificate from the Trusted root Certification authority. Please refer the article for more details.

Please note that this is a probable solution for this issue. We need to find the exact error/issue details by enabling appropriate logging.

Note:

We can make use of below command to list the non-self-signed certificate exists on the trusted root authority.

Get-Childitem cert:LocalMachineroot -Recurse | Where-Object {$_.Issuer -ne $_.Subject} | Format-List * | Out-File “c:computer_filtered.txt

Hope this helps !!

Office Add-ins community call – June 2021

by Contributed | Jun 16, 2021 | Technology

This article is contributed. See the original author and article here.

Call Summary:

This month’s community call features presentations – Excel v1.13 API updates (highlights 2 new APIs  insertWorksheetFromBase64 and onFormulaChanged event), Outlook Add-ins – Build 2021 recap (GA for Event- Driven Add-in with onCompose Event and for Mailbox 1.10 for Outlook), New Email Signature Add-in (Exclaimer’s Outlook Add-in product uses latest Outlook Add-ins capabilities), and PnP: Insert template from external Excel file (insert external Excel file into the open Excel worksheet and populate it with JSON data).  This month’s Community spotlight recognizes MVPs Damien Bird (DamoBird365) and Maarten van Stam.  Thank you!    Q&A in chat throughout call.  The call was hosted by David Chesnut (Microsoft) | @davidchesnut. Microsoft Presenters: Raymond Lu and Juan Balmori | @juaneloBalmori.  Special guest presenters James Wayne and Phillip Vetter from Exclaimer Cloud.  Recorded on June 9, 2021.

Agenda:

June’s call, hosted by David Chesnut, featured the following presenters and topics:

• Excel API updates – Raymond Lu (Microsoft) – 1:31


• Outlook API updates – Juan Balmori (Microsoft) | @juaneloBalmori – 13:17


• New Email Signature Add-in – James Wayne (Exclaimer Cloud) – 21:27


• PnP: Insert template from external Excel file – David Chesnut (Microsoft) | @davidchesnut – 37:12

Q&A (Question & Answers)

Unfortunately, we had some issues with the chat during the call. We apologize to folks who were not able to ask a question. If you have a question, you can reach out to us by using our short survey form. We’ll address any questions in the form during the next call.

Can you fix Teams add-ins functionality for online meetings? Association between Outlook events and online meetings is non-existent. The Teams SDK currently works online with single instance meetings, but there is no way to associate custom data with event instance and event series. For example, the SDK does not let you get meeting instance start time.

We can help with Office Add-ins development, but this is a good question for Microsoft Teams. We recommend asking this question on office-teams-app-dev – Microsoft Q&A. Thanks!

Are there plans to provide access to the Outlook auto-complete list via office-js? The list is available in the UI on mobile, OWA and desktop clients while entering recipients. It would be useful for us to be able to access it (or a list of commonly used email addresses for the user) via office-js to check the entered recipients.

There are no plans at this time, but this sounds like a great idea! Please create a feature request for this on our ideas page at https://aka.ms/m365dev-suggestions. Thanks!

There are many videos and articles aboutsSingle sign-on for Office Add-ins. The Yeoman generator uses the NPM package “msal” but there is also an NPM package called “@azure/msal-browser” and another one called “@azure/msal-react”. Can these all be used inside an Office Add-in? Which ones are the recommended ones to use?

 In general you can use most web libraries with an Office Add-in. For SSO you don’t need an authentication library to get the user identity token, since you just call getAccessToken(). However, you should implement a fallback sign-in dialog for scenarios where SSO will fail. In these cases using an authentication library makes the process easier. There is no requirement to use MSAL, but if you do, you should use the official MSAL package for the framework/language of choice as recommended by Microsoft Azure. For more information see Enable single sign-on for Office Add-ins – Office Add-ins | Microsoft Docs

I am attempting to implement the shared JavaScript runtime. However, I get an error when adding the <Runtimes> section. The error is: The element ‘Host’ in namespace ‘http://schemas.microsoft.com/office/taskpaneappversionoverrides‘ has invalid child element ‘Runtimes’ in namespace ‘http://schemas.microsoft.com/office/taskpaneappversionoverrides‘. List of possible elements expected: ‘AllFormFactors, DesktopFormFactor’ in namespace ‘http://schemas.microsoft.com/office/taskpaneappversionoverrides‘.

This error can occur if the <Runtimes> section is not in the expected location. Be sure to put the <Runtimes> section just below the <Host> tag as follows:

<Hosts>

  <Host xsi:type=”Workbook”>

  <Runtimes>

    <Runtime resid=”Taskpane.Url” lifetime=”long” />

  </Runtimes>

In general if you run into a manifest error, you can compare the manifest to one that works and look for any significant differences. For example you could compare against this PnP sample manifest that uses a shared runtime.

You can also run manifest validation which can provide more information about the error.

Resources:

Excel API updates

• insertWorksheetsFromBase64 – Work with workbooks using the Excel JavaScript API – Office Add-ins | Microsoft Docs


• onFormulaChanged – Work with worksheets using the Excel JavaScript API – Office Add-ins | Microsoft Docs


• getDirectDependents – Work with formula precedents and dependents using the Excel JavaScript API – Office Add-ins | Microsoft Docs


• Workbook.onActivated – Work with workbooks using the Excel JavaScript API – Office Add-ins | Microsoft Docs


• Table.resize – Work with tables using the Excel JavaScript API – Office Add-ins | Microsoft Docs

Outlook add-ins Build conference recap

• Try out event-based activation – https://aka.ms/LearnEventBasedAddIns

Exclaimer Cloud Signatures Outlook add-in

• <TBD: Link to demo video>

PnP: Insert an external Excel file and populate it with JSON data

• PnP sample: Insert an external Excel file and populate it with JSON data

Office Add-ins community call

• Recurring, monthly community call calendar invite


• Community call topic requests and questions


• Community call recordings on the YouTube Office Dev channel

Office Add-ins feedback

• Technical questions – Microsoft Q&A (office-js-dev), (office-addins-dev)


• Issues – GitHub 


• Recommendations and suggestions – Microsoft 365 Developer Platform ideas

The next Office Add-ins community call is on Wednesday, July 14, 2021 at 8:00AM PDT. Get the calendar invite at https://aka.ms/officeaddinscommunitycall.