Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

No Restriction with Pass-Through Authentication

Kind of an issue since we have customer's looking at Orion. We moved the website to pass-through authentication, works great, except login's that have restrictions (in this case node name pattern) don't get the restriction applied passed the home page. We have custom home pages built with the same restriction put on them and those work, but clicking passed that (Top 10, Overview, etc.) allows the user to see *all* nodes. Is there a configuration piece I'm missing?

Find more posts tagged with

Accepted answers

All comments

BXIV

I restrict my users by custom departments and top 10, home all show only their devices....adv syslog parser shows all, but if a user tries to click on something they don't have rights too they get an error.

FormerMember

Ticket number 41879 - support cannot recreate the issue.

FormerMember

BXIV - support and I found that even if you change the custom.config file ('false' to 'true'), running the CW overwrites the file again. Attempting to change that and just restart IIS errors with permissions on the web.config file. So part of the setup seems to be broken. While pass though may be working, user restrictions on viewable nodes is not. Hoping to get this fixed soon.

Did you create a Top 10 page per department? How did you setup your restrictions (in the user creation or custom page)?

BXIV

I have just the one Top 10 page, I also have done a fresh install of 8.5.1 SP3; Front end twice and SQL once for this year. I did not have to change the web.config file to make the auth work, the only thing I remember changing is the IIS permissions for the Orion website to AD intergrated and removed the anon check and restart IIS. I also had the domain\everyone account specified in Orion with no password which forces auths to use unless a specific account is specified. On the 'Everyone' account I have it restricted by Custom node properties, and the only problem I have run into is giving access to MPLS reports with no access to the actual nodes.....which failed for me, so it was setup for only one person so far.

FormerMember

OK, so I fixed this. I can now have view restrictions across the entire web console enforced based upon the user limitation. Running the config wizard in step 16 from the instructions in the admin guide is actually not needed - it overwrites the custom.config file that changes the <identity impersonate="true" /> back to <identity impersonate="false" />. The initial error with the web.config file (ASP.net not having permission) is due to the account that is logging in not having the correct permissions on the site. I got around this by setting the server\users group permissions on the site to write/modify, restarting IIS, checking the login, restricting the server\users group back to read/execute, restarting IIS, verifying login. Interesting that the web server doesn't have to reside on the domain it's authenticating against. I'm trying to finish up a write up for support that details exactly how I got it to work.