Exchange Management Service Broker troubleshooting in K2 blackpearl

Points to take note:

  • The following screenshots are taken on K2 Core 4.1 VM with blackpearl 4.5 Update KB001420.
  • Exchange2010 and Blackpearl are installed on the same machine.
  • The logged in user is denallix\administrator.
  • Pre-requisites:
  • KB001189 quotes you need a second service account. This is not compulsory and I have used K2 service account to do all the operations. So only one account is sufficient.
  • All the errors start with “Please make sure the K2 service account has impersonation rights in Exchange” This is a misleading message, so ignore that bit and look for the text after that.


Option 1: Set Authentication Mode to ServiceAccount [DENALLIX\K2Service]

“DENALLIX\K2Service” is member of following AD roles:

With the settings in place, we can create a meeting “On Behalf Of” any user as shown in the next 3 screenshots

Error: The SMTP address has no mailbox associated with it.
Cause: This happens if the “On Behalf Of” field has an invalid email address or the email is not found in Exchange

Error: The SMTP address format is invalid.
Cause: This happens if the “On Behalf Of” field does not have a value in the format of a valid email address


Option 2: Set Authentication Mode to Impersonate [Enforce Impersonation is unchecked]

The following Exchange Management Shell screenshot shows “DENALLIX\K2Service” is part of Exchange’s ApplicationImpersonation role. This was done during installation by the K2 setup manager.

Get-ManagementRoleAssignment Role “ApplicationImpersonation”

If you want to know more about Role Based Access Control (RBAC), please check this:

With the above settings in place, we can create a meeting “On Behalf Of” any user as shown in the next 2 screenshots. The smartobject tester tool is running under the context of logged in user denallix\administrator


Option 3: Set Authentication Mode to Impersonate and check “Enforce Impersonation”

Since the logged in user is denallix\administrator, the Smartobject tester tool ran using those credentials:

Error: The account does not have permission to impersonate the requested user.
Cause: ‘denallix\administrator’ account is not part of Exchange’s ApplicationImpersonation role

new-ManagementRoleAssignment Name “_suImpersonateRoleAsg” Role “ApplicationImpersonation” User “”

Note: After executing the new-ManagementRoleAssignment powershell cmdlet, you must wait 5-10 minutes (depends on exchange setup) for the smartobject to pick up those changes.

After waiting for the exchange role refresh, you should be able to create the meeting with Enforce Impersonation enabled.


Option 4: ‘Run as different user’ option to launch Smartobject tester tool, Set Authentication Mode to Impersonate and check “Enforce Impersonation”

The error is same as explained previously. But if you try to execute the new-ManagementRoleAssignment powershell cmdlet, you will get an error as below:

This is due to the usage of same name “_suImpersonateRoleAsg” in the command. So delete the existing entry and then add the user to the role.

Remove-ManagementRoleAssignment “_suImpersonateRoleAsg”

The above screenshot confirms that _suImpersonateRoleAsg role will be removed which has Administrator as the member. Since the role has now been deleted, you can add “Run as” user to the exchange role.

As mentioned earlier, you must wait 5-10 minutes before trying to create the meeting request.

How to enable HostServer Logging in K2 blackpearl

To change Log level setting, follow the steps below:

  1. Make a copy of C:\Program Files (x86)\K2 blackpearl\Host Server\Bin\HostServerLogging.config
    • The path might vary according to your installation. Backup is just a precaution in case you edit the file incorrectly
  2. Open the config file and Search for the following section

 <ApplicationLevelLogSetting Scope=”Default”>
    <LogLocation Name=”ConsoleExtension” Active=”True” LogLevel=”Debug” />
    <LogLocation Name=”FileExtension” Active=”False” LogLevel=”Debug” />
    <LogLocation Name=”EventLogExtension” Active=”False” LogLevel=”Debug” />
    <LogLocation Name=”ArchiveExtension” Active=”False” LogLevel=”Debug” />

If you want to do a full file trace for all details, edit the FileExtension line in the config file. Change the Active key to True and LogLevel to All.

Warning: For a production setup, you should enable the FileExtension logging and set the LogLevel to “Error”. If you set it to to “All”, the log file can grow pretty quickly into a very large file and should be monitored at regular intervals. It should look like this.

<LogLocation Name=”FileExtension” Active=”True” LogLevel=”All” />

  • Save the config file and restart the K2 host server service.
  • Note that the trace information will get logged into a file called HostServer<current date>_1.log and is located in the same folder.

  • To revert back to your old settings, replace the modified config file with the original copy.
  • Restart the K2 Host server service to stop the file logging.