A customer of mine had this one after completing the upgrade to SP1 recently, basically all cube building would fail with the following error:
Your CBSRequest job failed. Its current state is FailedNotBlocking. It was 0% complete. It entered the queue at 09/02/2011 11:00:26.
[snip…]
The errors returned from the queue are as follows:
Error ID: 17007
Error ID: 26000
[snip…]
<class name="CBS message processor failed">
<error id="17007" name="CBSOlapDatabaseSetupFailure" uid="7d14c29d-a133-492b-baea-2e7c0bec444b" QueueMessageBody="Setting UID=00007829-4392-48b3-b533-5a5a4797e3c9 ASServerName=server ASDBName=FullCube1 ASExtraNetAddress= RangeChoice=0 PastNum=1 PastUnit=0 NextNum=1 NextUnit=0 FromDate=01/04/2010 00:00:00 ToDate=12/31/2011 00:00:00 HighPriority=True" Error="Error Setting Olap Database ‘FullCube1’ roles: Error: This method can only convert identity claims, and only when a logical conversion exists.
Parameter name: encodedClaim" />
This customer is using Claims-NTLM (ie AD users via Claims) for logins and that seems to be the cause of this issue. The give away is clearly in the error: “This method can only convert identity claims”.
Solution
Fortunately the solution turned out to be rather simple, it seems that SP1 does some additional checking when setting up the Cube Roles, as a result when users in the Project Server have issues then this error is caused.
A little more info can be seen in the ULS log:
09/02/2011 12:00:33.18 Microsoft.Office.Project.Server (0x17B0) 0x1A04 SharePoint Foundation Claims Authentication d01p Medium ConvertWindowsClaimToWindowsPrincipalName() encountered error: Some or all identity references could not be translated.
As it turns out a number of users in PWA have left the company and in this case as no AD-sync is used some of the accounts had been deleted from Active Directory but not updated in PWA server settings.
It seems also that accounts set as “inactive” also caused this error if they were in a group with the Global “View OLAP Cubes” permission.
The fix was to remove those user accounts from the PWA groups ‘Project Managers’, ‘Portfolio Managers’ and ‘Executives’ (and any others with the above permission).
Finally I just tested this in a non-Claims lab, and the problem doesn’t occur, in fact the cube log identifies and lists the invalid account then continues processing, so technically I would call this one a code defect.
Hope that helps someone else out there!