Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Automatic Domain Logon

I wanted to share my recent configuration for authentication into Orion. From any XP/2000 workstation, I can type http://solarwinds and be authenticated without typing my domain password.

I have enabled "Integrated Windows Authentication" in IIS, added domain\username into Orion accounts admin, and have a CNAME DNS entry for "solarwinds" which points to the server’s real name.

Our internal DNS domain is corp.ad, so if you type in http://solarwinds.corp.ad, you are prompted for a password. If you type http://solarwinds, you aren't. You are still authenticated by active directory, but using the credentials you logged onto your workstation (so obviously you have to logon onto the domain and not locally).

It’s all very neat and works well. I should mention that if your domain account isn't in the Orion admin list, then you are prompted for a logon. So from a non-authenticated user you can override with your credentials.

By the way I'm using Orion 7.5.15 on Windows Server 2003 (standard).

Find more posts tagged with

Accepted answers

All comments

BryanBecker

I'm having a similar issue per say. I have the pass-thru configured as well. I have accounts set up domain/username. Where domain is the domain we log into every day.

The problem I have is even with the above set you still get prompted for username and password. Also even if you put int he correct credintials you still don't get in. The only way I've gotten this to work was to add each user that needs access to the site as a local admin on the server.

This is not the way I wanted it to go for sure but I have no other way around it.

Network_Guru

Another thing to be aware of - proxy servers can strip the passthru authentication.
Make sure you have a proxy exception for your Orion server listed in your browser connection settings if you are pointing your browser to a proxy server.
ALSO;
When I use the Win2k AD server name in my browser, passthru works flawlessly.
When I use the CNAME http://solarwinds to connect, I get a local login prompt from Orion & passthru does not work.

-=Cheers=-
NG

BryanBecker

I tried this again today :

http://orion and http://orion.domain.com both prompts me for credentials. Even with typing in the right credentials I still can't be authenticated.

Only way to make this work is add the user as a local admin on the server.

I'm going to contact Solarwinds again today.

pwinterhalder

Make sure you have domain\username and not domain/username as you have written.

In addition, are you logging on via a 2000/XP workstation to your NT/AD domain, and is that workstation a member of your domain?

The proxy server point is important - are you using one?

Seashore

It's funnt, I have it the other way around.
http://orion promts me for password but http://orion.domain.local does not!

BryanBecker: You can come in when youre user is local admin I aunderstand. Can it be so that youre usual account don't have NTFS-rights to the webfiles? Suggest you check that. The windows-account you use to access orion should need at least read-access to all files under x:\inetpub\solarwinds.

/SeaShore

BryanBecker

I'm not sure this is required for eveyone but we got it to work. Basically the users need the policy settings of "access this computer from the network". I was then able to move the non-admin users from the administrators group into the users group. The users group has that policy so it's now working and I don't need to have them as admins.

Thanks for everyone's assistance.

BB

Network_Guru

I just rebuilt my server from Win2k to Wink3. After re-installing 7.5 I just went into the IIS Security properties for the NetPerfMon website and disabled anonymous login. "Use Windows authentication" is already selected by default.
Passthru worked fine with no other changes required.

Just make sure you have each user defined in the Orion Web Account Manager interface as <domain\username>

-=Cheers=-
NG

DonYonce

Another tip for Domain passthru.....

You can add an Orion web Account named "MyDomain\Everyone" (use your own Domain name) to configure settings for all users in a Domain. You can also configure particular users from the same domain by adding accounts more specific to them. For example, add an account named "MyDomain\Don" and give it Admin priviledges.

An Example :

Add a web Account called "MyDomain\Everyone" and set it to minimal permissions and default views and menu bars.

Add another web Account called "MyDomain\Don" and give this account Admin rights.

Add another web Account called "MyDomain\Fred". Then disable the Account. Uncheck the "Account Enabled" checkbox from "Account List".

Everyone in MyDomain now has "Domain Passthru" enabled.
Everyone in MyDomain will get the default permissions, except, when Don logs in, he gets Admin rights and Fred cannot login at all. Fred is explicitly barred from access to the Orion web site.

Once again.
Be sure to select "Use Windows authentication" and disable "Anonymous Login" from within IIS Administrator. This is required for Domain passthru to operate.

edbrisenio

Hi. I just want to share what I did on my Orion Web Enabled 7.8. Instead I use Integrated Authentication, I use Basic Authentication and I enable SSL on my Web. I am currently using Windows 2000 Active Directory as my source of accounts. When a user logs in, he will just input "username" and "password". No need to have a domain. I tweak a little bit on my webserver. In order to use Basic Authentication, on the Local Policy, I added users to "log on locally". I also setup Cygwin SSHD so that users will access first on the server before on the routers. Changing of their password would be on SSH by typing "passwd". I have also setup IAS RADIUS so that accessing routers will be authenticated by my Active Directory. Very easy to manage user accounts.

bgross_raa

I have Pass-thru authentication enabled on my Orion server and all works great. My question is this, does anyone know of a way (or a workaround) to authenticate AD Groups as opposed to individual users? Is this possible? If not, does SolarWinds plan on adding this functionality any time soon?

What I am trying to do here is provide pass-thru authentication based on the AD group a user belongs to, instead of the username itself. We have a large amount of turnover in particular groups that need access to the Orion info, and maintaining all the usernames is a headache. If I could authenticate based on the AD group they belong to, it would alleviate this problem.

Network_Guru

I too have the same issue/request.
If anyone has Passthru authentication working with AD groups, please feel free to share here. Otherwise, I too would like to add this as a feature request.

-=Cheers=-
NG

vaibhav14

Hi All,

I am using Windows Authentication with Pass Thru and it works fine. I use a laptop to work in my office and when I am working on it at home, I connect to the office over a VPN client connection. Now, when I access the Monitoring website from office, it works pretty well. However, for some reason, it works from my home ONLY if I am connected to the office network over VPN. Otherwise, it does not even prompt for user credentials and throws a 'Page not found' error.

I am using IE7 beta on Windows XP pro and my machine is member of the production Win 2003 AD domain.

Please note that the website has a public IP address and I access the public IP both from work and home. Additionally, the website is hosted on a separate isolated network (using Firewalls) and is in its own Windows AD domain - separate from production domain.

Any ideas?

TIA
Vaibhav

SW50062

quote:Originally posted by BryanBecker

I'm having a similar issue per say. I have the pass-thru configured as well. I have accounts set up domain/username. Where domain is the domain we log into every day.

The problem I have is even with the above set you still get prompted for username and password. Also even if you put int he correct credintials you still don't get in. The only way I've gotten this to work was to add each user that needs access to the site as a local admin on the server.

This is not the way I wanted it to go for sure but I have no other way around it.

Try using the format below, otherwise you are authenticating to the local server nad not AD.

Username = domain/username
password = password

Scott Eddy
ITS Network Specialist

mjhamilton

I'm not sure this is required for eveyone but we got it to work. Basically the users need the policy settings of "access this computer from the network". I was then able to move the non-admin users from the administrators group into the users group. The users group has that policy so it's now working and I don't need to have them as admins.

Thanks for everyone's assistance.

BB

ok I am a little stumped here.. unless I put my user in the local admin group for the server the AD authenticaion wont work,, I am sure it has something to do with the policy mentioned above... where do I need to go to enable this policy for the power users or even the users group in win2k3?