SWIS API Auth Issues

pramod.paul.jose

Hi all,

I have got Solarwinds setup where we have Authorisation roles configured based on AD groups.

A few users who belong to the same AD group and got the same privileges are not able to access the SWIS API via curl or python, but others in the group can.

These users are also not able to login to SWQL Studio too. They got an error message when they try with Server Type : Orion (v3)
--> Unable to connect to Information Service. Invalid username or password
These same users are able to login to SWQL Studio successfully when they use the Server Type : Orion V3 AD.

Can you please help us explain why these users are not able to login with Orion (v3). Our use-case is to run some python script across a set of devices and at the same time mute alerts from them using SWIS. We get a "forbiddden" response for SWIS query for some users.

Regards,
Pramod

Find more posts tagged with

swis

information service

SWQL

Accepted answers

Martin_Crothers

Sounds like an AccountSID mismatch/missing.

https://thwack.solarwinds.com/product-forums/the-orion-platform/f/orion-sdk/44700/swis-swql-studio-api---windows-group-authentication-issue

https://thwack.solarwinds.com/product-forums/server-application-monitor-sam/f/forum/21840/active-directory-group-account-cannot-log-in-because-objectsid-changed

All comments

KMSigma.SWI

Have they logged into the web interface at least once? For some reason I thought there was a requirement that they needed to log into the web console at least once to build the necessary tables that capture their specifics into the database.

pramod.paul.jose

All these users with the issue are frequent GUI users.

Is there any logs/tables specific to SWIS which I can check to debug the issue.

shuth

Potentially the Orion.InformationService.log file located here: C:\ProgramData\SolarWinds\InformationService\v3.0\

pramod.paul.jose

Found the below error in the log

2022-02-03 11:56:08,629 [269] WARN SolarWinds.Data.Providers.Orion.OrionAccountValidator - (null) (null) Invalid username or password for user 'Axx\xxx24a' via password hash comparison

The same password works well with the GUI.

Can it be an issue with OrionAccountValidator module ?

GranvilleG

Pleased to see your issue as I think I have the same problem, I am also confused and in need of light on this same issue.

Live The Orange Life

pramod.paul.jose

The powershell script given by Edwin Hoekman was able to solve my issue. Did you try that ?

Refer: SWIS / SWQL Studio / API - Windows Group Authentication Issue - Orion SDK - The Orion Platform - THWACK (solarwinds.com)

These were my symptoms for the issue : :

1. API Requests fails as “Forbidden” while GUI access has no issues.

2. In the log file "C:\ProgramData\SolarWinds\InformationService\v3.0\Orion.InformationService.log".

2022-02-03 11:56:08,629 [269] WARN SolarWinds.Data.Providers.Orion.OrionAccountValidator - (null) (null) Invalid username or password for user 'Domain\Userxxx' via password hash comparison

3. AccountSID column is blank in the table Orion.Accounts for the user