Corey Roth [MVP]

When attempting to configure the Business Data Catalog for use with MOSS Enterprise Search, it can be quite common to get this message when you try crawling for the first time.  The cause is actually pretty simple, but I figured I would give some troubleshooting advice today.  When you get this error, the fact is, your Enterprise Search crawl account cannot access some portion of the item in the BDC.  When crawling, permission has to be given to the crawl account in three different places: the BDC itself, the Application Definition you are crawling, and the individual entities inside the Application Definition.

When troubleshooting this error, the first thing you need to do is identify your crawl account.  The easiest way to do this is to go to the Search Settings page on your SSP and see what the default content access account is.  When looking for the source of this error, you can try looking in the Event Log, but typically the only time you see an error in there is if you are indexing a SQL Server data source and the crawl account doesn't have access to the SQL Server database.  This is a good time to check and make sure that the crawl account does have access to the database.  Your next best bet is to check the latest log file in your 12 hive's LOG folder.  Search for something like "Access Denied" and see what you find.  Here is an example of what I found.

Closing chunk on Exception: Access Denied for User 'MOSSTEST\MOSS_Search'. Securable MethodInstancewith Name 'GetGetContactIdsResultsInstance' has ACL that contains:      User 'MOSSTEST\administrator' with Rights 'Execute, Edit, SetPermissions, UseInBusinessDataInLists, SelectableInClients' 

In this case, my error is indicating that my crawl account did not have access to the entity itself.  Let's assume though that we don't know what permission is needed.  First, start off by going to the Business Data Catalog Permissions link on your SSP.  Make sure your crawl account is listed and that it has Execute and SelectableInClients permissions.  You can try and click the Copy all permissions to descendants link and hope it copies the same permissions down to the application definition and entity itself, but more than likely it won't work.  So, the next step is to go to the Application Definition, and make sure your crawl account has the same permissions there.  Again you can try the Copy all permissions to descendants link, but I recommend also going to each entity and verifying that your crawl account has permission. 

At this point, try crawling again and hopefully everything will work.  To alleviate some of the pain in the process, you can also set your permissions via Application Definition.  One thing to note is that I have tried just granting Domain Users (or some other group) the needed permission to crawl, but it does not seem to work for some reason.  It seems that you must explicitly grant access to the crawl account (and not some group that it is a member of) for the crawl to succeed.  I have set up numerous BDC Crawls and it seems like I still run into this error on a regular basis.  Hopefully, with these steps, you can get your crawl to run.  If you can't get it to work, try checking your log files.