Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

AD Logins with Orion & EOC In Different Domains

Were currently implementing EOC for the first time in addition to a second Orion poller. The new Orion poller is in our DMZ domain and the EOC server is in our internal network. We have allowed port 17777, per the documentation, on our firewall between the two servers. I'm not having any issue accessing the DMZ Orion server via EOC, but we're unable to view any Node Details. Getting error "403 Forbidden" when a select an individual node. Could this be a problem with the credentials? The AD authentication that were using in the internal network is totally seperate from the AD authentication that takes place on our DMZ server. What can we do to resolve this?

Find more posts tagged with

eoc_1.3

orion_credentials

authentication

Accepted answers

All comments

martin.kunc

Hi DirtySouth,

before testing EOC drilldown to the Orion, I would try to connect to the Orion directly, from the machine, you will be using EOC web console. Are you able to get there some credentials ?

EOC drilldown to Orion uses credentials, that are set for Orion under Manage Account, (unless you are using AD credentials, these are not passed anywhere for security reasons, but you can configure Windows NTLM to autologin you in intranet).

If you will be able to login to Orion without EOC, I would try to set these credentials under Manage Account.

Usually, when there is some credentials problem with orion, you should get back Login form when some message like Login failure, so the 403: Unauthorised looks like some environmental problem and I would start with the check if you are really able to reach Orion server directly without EOC, first from the client machine that open EOC console and then from the EOC server, which does the redirection to Orion.

DirtySouth

My DMZ Orion box is in a seperate domain with it's on Active Directory and uses pass-through authentication. My EOC server is in our internal domain with a seperate Active Directory and uses pass-through authentcation. Since users are being authenticated against two seperate AD's, will they ever be able to be tied together?

DirtySouth

Also, I cannot test access to the DMZ Orion server from the EOC server because they are seperated by a firewall and HTTPS is not allowed.

martin.kunc

Hi,

you can set up the Orion Accounts instead of AD accounts to access the Orion Server detail and drilldown (click on node detail) will then use the Orion Account to authenticate you in Orion. This should solve the crossdomain scenario with authentication. For example you can try to setup the Orion Admin account under your Manage Accounts for the Orion.

Are you able to access the Orion server without EOC using Orion account, or it is also blocked by fw ?

DirtySouth

If I understand your question correctly, I cannot browse to the DMZ Orion web-interface from the EOC server due to the firewall. We are only allowing port 1777.

As far as the ID's go, how do you tie the DMZ pass-through authentication to a local account? If EOC users are accessing the EOC web-interface using pass-through authentication, how does that get tied to a specific local account?