Problems with AD Authentication in Orion

I have setup four different security groups for users that access Orion. These have worked flawlessly for quite some time and I think I am having an issue.

Issue 1 - I added a user to an AD group for access three days ago. If the user goes to try and login they get an error that the user name and password is incorrect. From what I can tell it should work. I went and checked under Advanced AD settings and it can connect to the DC and get info. Not sure why this is not working for the new user.

Issue 2 - I am working on setting up dashboards and setup an Executive Review dashboard/login with very limited access just access to very specific places. I setup an AD group for this as well and setup some users as tests and they cannot login either.

Where would I find logs that may give me details as to why this is happening? Thanks! Dave

Find more posts tagged with

Accepted answers

All comments

christopher.t.jones123

@martian_monster,the logs for AD auth can typically be found in the OrionWeb.log located in the C:\ProgramData\SolarWinds\Logs\Orion directory. You may have to adjust it to do debug if you can't see it in there, that's where i've usually gone as a starting place to troubleshoot AD auth issues

martian_monster

Thanks! I will give that a try and/or open a ticket with support. It looks like my AD auth for Solarwinds is not working with anything new.

alansmith

I've had this before. What happened in my instance was the server team removed my ad connection account without validating it was a required account. I've also had it where the removed the account rights for it do to its connection thing. I would check the service account rights within AD to make sure they are still there.

mikegale

I've seen issues with "Scope" in AD where groups are set to local but the whole AD environment spanned multiple domains so the scope needs to Universal or Global. Also, bad or old certificates on the server can cause log in issues. Add yourself to a group and try logging in to the UI on the actual web server or the main poller and see what happens.

martian_monster

Are you talking about the Solarwinds service account I use for monitoring? I just did the AD check and test with the Solarwinds service account and it did work.

martian_monster

I have setup an Executive Review group with limited access and have my regular account in that one and it does not work. I tried in different browsers and also with different users and no go.

martian_monster

Does anyone know if Orion can support different AD Groups? I had four groups setup right now - Admins, User, Viewer, Executive Review and right now only the Admins work but no new Admins work. Support has me going around in circles and are sending me things I have done and checked over. Thanks!

KMSigma.SWI

One other thing that I ran into was the order in which they were entered. If I'm remembering right (and I may not be so check the support documentation), they should be in order of ascending permissions. So "Viewers" first, then "Users", then "Admins" and "Execs" somewhere in between (depending on level).

martian_monster

This is all the documentation I can find right now https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-enable-ldap-authentication.htm

martian_monster

Support just came back with -

LDAP is turned on. You only have to configure advanced LDAP authentication if the Orion server is not a member of the domain of the individual/group users who can access the web console. If the Orion server is a member of the same domain as with the users, there's no need to turn on LDAP.

Seriously? If they would pick up the phone and call instead of this email back and forth they would know that Orion is not in the same domain that I am trying to authenticate against. I was hoping that using AD groups was going to be easier LOLOLOL.

christopher.t.jones123

@martian_monster, when you compare a non-working account with a working account of the same AD group in the Accounts table do they have the same values in that table? between the two accounts, the population of the columns should match while the individual values within them may differ. For example, if you look at both of them is the AccountSID column populated for both, the values within them will be different but they should both be populated. Also what does the OrionWeb.Log state is occurring when a user cannot log in?

martian_monster

I figured I would come in here and close the loop.

Issue 2 - I removed the LDAP information and removed the groups and added them back and things are working. Yaay!

Issue 1 - The Identity Team is working on a new tool to automate account creation. They were deploying Administrative accounts with this tool before going live with everyone. This tool was deploying administrative accounts and missing one very important thing.

Thank you everyone for playing and everything is working.

KMSigma.SWI

Can I just say "wow...." Why would you ever skip creating UPNs? It makes no sense to me.

The good news:

You found an issue (in someone else's system) and reported it.
You got it working again.

martian_monster

Yes - this was turned into a bit of a learning exercise.