Dashboards on all staging server sites display Authorization Required Error

[bmartz]

Hi,

On our staging server, we currently have multiple instances of our site for development, content creation, and upgrade validation purposes. All sites are running CiviCRM 4.3.5 except for one site that has been upgraded to CiviCRM v4.4.6. The CMS is Drupal 7. When administrators visit the CiviCRM homepage on any of the staging server sites, all dashlets display the following error:

Authorization Required
This server could not verify that you are authorized to access the document requested. Either you supplied the wrong credentials (e.g., bad password), or your browser doesn't understand how to supply the credentials required.

I'm new to CiviCRM. Furthermore, I cannot attest to whether or not the dashlets ever worked on our staging server (I suspect not). We have Apache configured for HTTP authentication using a passwords file encrypted by htpasswd to keep out crawlers, etc. We also use an SSL certificate (which is expired and is in the process of being renewed). I'm not aware of the certificate breaking dashlets based upon my research. I can state our production environment works successfully; the certificate has already been renewed and there is no Apache level authentication.

Using some console.log() calls, my debugging led me to find the authentication error being thrown at this line:

   $.getJSON(opts.ajaxCallbacks.getWidgetsByColumn.url, opts.ajaxCallbacks.getWidgetsByColumn.data, init);

in the source file

   sites/all/modules/civicrm/packages/jquery/plugins/jquery.dashboard.js

I've attempted to replace the .getJSON() call with an equivalet .ajax() and I get the same Authorization Required error. I then modified the .ajax() call to add the apache username and password to the headers as follows:

   $.ajax
   ({
     type: "GET",
     url: opts.ajaxCallbacks.getWidgetsByColumn.url,
     dataType: 'json',
     async: false,
     headers: {
        "Authorization": "Basic " + btoa("username:password")
      },
     data: opts.ajaxCallbacks.getWidgetsByColumn.data,
     success: init
   });

Unfortunately, I get stuck in a loop whereby I challenged by the web server, submit the credentials, and get re-challenged over and over again (I tried over 20 times in case I was getting prompted per page resource).

At this point, I'm not even sure I'm barking up the right tree. So my question is this...is CiviCRM set up to handle HTTP authentication out of the box? Does anyone see what I may be doing wrong given the provided information?

Sorry in advance if this has already been answered, but I did not find any solutions that work.

Thanks.

[Hershel]

Are the main page and also the JSON calls using the exact same domain name? Both have or don't have www in front?

[bmartz]

I don't see any indication of cross domain activity. My console output for opts.ajaxCallbacks.getWidgetsByColumn.url outputs the relative URL /civicrm/ajax/dashboard and Chrome's Log XMLHttpRequests feature outputs addresses with the same domain as the main page.

As far as the sub-domain, we use staging, dev, test, test2, etc. None of the sites on the staging server use www.

[Hershel]

If you open one of the Ajax calls in a new browser tab, it also asks for authentication?

Generally speaking, with Apache-based HTTP authentication, CiviCRM works fine, so long as the Ajax calls are on the same domain once the main page is authenticated, then all calls on that browser are fine.

[bmartz]

Interestingly, I can open up a dashlet using the magnifying glass icon to view in full screen mode. It appears to be a function of the dashboard container itself. Dashlets wrapped within the dashboard require authorization when executing this path:

     /civicrm/ajax/dashboard?op=get_widget&key=<the_key>&id=1

But the same dashlets display successfully when launched in fullscreen mode as a popup dialog box using this path:

     /civicrm/dashlet/activity?reset=1&snippet=5&context=dashletFullscreen

I'm working on opening up an Ajax call in a new browser tab. If I simply open an anchor tag in a new tab with the url /civicrm/ajax/dashboard?op=get_widget&key=<the_key>&id=1, I still get the 401 error and the following is the response that gets displayed:

     {"title":"Activities","name":"activity","content":"\n\n