10.1 & AD authentication

Greetings,

Upgraded to 10.1 and I'm trying to get an AD account set up. After following the procedure outlined in this post () to create the account, I am presented with the following error on the web page:

Logon Failure: the user has not been granted the requested logon type at this computer.

I can't seem to find the reason for the failure. Any ideas?

Thanks,

Jim

Find more posts tagged with

error

ad_integration

Accepted answers

All comments

bshopp

Make sure your account has the right AD rights. If you go and look at the Accounts table in the database, the last column should be SID. If that is blank, then your account does not have enough rights. Either get someone with high rights or get your account updated, delete and try re-adding

JBall

Thanks for the quick reply. The three accounts I attempted to add all have the AccountSID field is populated with SID's on those three accounts.

bshopp

Are they logging in with their domain/username? Are they trying the Windows password to log in?

JBall

Yes. One of the accounts I'm testing with is mine. First I added the AD group that I'm in but that didn't work. So then I tried just adding my account and that is also failing. Same error both times. There is one more account that I've tried and it also fails. All three (AD group and both accounts) show AccountSID's in the Account table.

I should add that I've tried both domain\account and username@domain.

JosephRLee

We have the same issue. Granting local login is out of the question. Although we would like to take advantage of this feature, we are unable to do to security.

bshopp

Are you logging on manually (the login gateway page), and supplying domain\username credentials?

When that happens, the Orion server validates those creds with a “Logon” on the server. If you are using domain creds at the login page then they are considered anonymous, and so must be validated by the server.

I’d suggest you enable Windows account login (enable automatic login)… if the machine they’re accessing Orion server on is on the same domain as the server itself then IIS takes care of the Windows Auth side of things automatically, and we use that token to login to Orion. If not, and they log in with domain creds manually, then the server needs to validate those creds with a “logon” on the server. In this case it looks like the server won’t allow that, hence the “Logon Failure: the user has not been granted the requested logon type at this computer” Error.

Questionario

We are also experiencing problems with AD groups...

error message in the log file is that the group contains a null SID

has anyone ever experienced this and fixed this?

bshopp

null SID means the account you are using to access AD does not have the right amount of access. To to get more AD access to your account then delete and re-add

FormerMember

Fulfilling Brandon's criteria solved the issue here. Although it was not our ideal method, it was much better than the alternative local login solution.

Thanks!

bshopp

What would be your ideal method? Can you elaborate?

wgorrod

I had the same issue with the user not being granted the requested logon type. One work around that may not work for some is to give authenticated users read access to the website directory.

Questionario

well, the user I tried to login with was myself and I definitely have read access to the server...

anyone got a clue on what could be the problem?

we're currently investigating as well, if I find the problem I will post it here too

Questionario

Hi,

the problem solved itself for us, when trying to add the group several times, it finally worked for some reason... hope it stays that way but we still don't know why it initially didn't work!

FormerMember

I'm finding I'm having the same issues.

Upgraded and when I tried to add a DOMAIN ADMIN account, the logon works fine. But if another (lower-level) admin or regular user account I get the same error - Logon Failure: User has not been granted the requested logon type at this computer.

I also had issues with domain GROUP accounts. They did not work at all. It seems to only work when I add individual full domain admin accounts. What security settings are preventing this from working properly?

netlogix

I don't think the issue on this is anything that Solarwinds can fix. It is a IIS issue. If IIS won't authenticate the User, the NPM can't piggy back on that. Get IIS to auth the user and you should be good to go.

Questionario

I think the authentication works fine (we have the same problem).

It seems more like the settings are either not saved or the association to the user is incorrect.

I heard dev might or might not ever fix this but dev will decide when or if this will be fixed, no further information can be given.

basically, if not enough people open a ticket for this, they're not gonna fix this anytime soon.

JesperVestergaard

Right...

I´ll go create ticket for this,

Denys.Pavlov

Hi JBall, have you allowed user to log on locally on Orion server (see image)?

If AD account is not allowed to log on locally it won't be able to log in to Orion web site.