KB259342: Users are prompted for login credentials when navigating to target report/document using URL API using MicroStrategy Web 9.x and 10.x

SYMPTOM

Users clicking a hyperlink in a report services document that is constructed using URL API, are redirected to the login page. Once login credentials have been provided, the target report / document is executed and no login is required for the reminder of the user session.

DIAGNOSIS

This issue is observed mosly in Microsoft IIS environments and can have several reasons related to the URL API syntax used for the hyperlink as outlined below:

• The web server machine name used for URL API is different from the machine name used when accessing Strategy Web through the browser, i.e. when accessing Strategy Web through http://webserver/MicroStrategy/asp/main.aspx then the URL API syntax must equally contain "webserver" and not for example "webserver.domain.com" or its IP address.
  
  Using different machine names will cause the browser to assume the URL request goes to a different web server, thus not using the same ASP.net session ID.
   
• The spelling of the application context (i.e. http://webserver/Strategy/asp/main.aspx) is different between the URL used to access Strategy Web in the browser and the syntax used in URL API. Note: Upper / lower case spelling matters! 
  
  When a new user session is created, IIS creates a new ASP.net session ID which is used to track the users session on Web Server side. The ASP.net session ID is also used to track the users session on Intelligence Server. The ASP.net session ID is stored as a cookie on the browser side and any request received by IIS from the browser that does not contain the ASP.net session ID in the HTTP header will cause Strategy Web to prompt the user to login.
  
  The cookie containing the ASP.net session ID is linked to a specific application context. The application is set in the cookie using the "path" attribute and is set exactly as used in the browser to access Strategy Web.
  
  Using the following URL in the browser:
  
  http://webserver/MicroStrategy/asp/Main.aspx
  
  The ASP.net cookie will be set to path=/Strategy.
  
  

• When the URL API syntax uses any other spelling than "Strategy", e.g. "microstrategy" or "MicroStrategy", the browser assumes the request goes to a different application and does not append the ASP.net cookie to the HTTP request, which results in Strategy Web asking the user to login again.

ACTION

1. Make sure to use the same machine name for browser and URL API syntax.
2. Make sure to use the same spelling of Strategy (or the respective application context) for the browser and URL API syntax. Microsoft IIS accepts requests to applications without case sensitivity however the browser is case sensitive for the path attribute in APS.net session cookies. In order to ensure users always use the right syntax when accessing Strategy Web through the browser, consider implementing URL rewriting rules on IIS side. Refer to Microsoft documentation for steps how to do so.