This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.

You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Solarwinds SWQL Studio - AD USERS NOT ABLE TO LOGIN

pramod.paul.jose over 1 year ago

Hi all,

We have been active users of Solarwinds SWQL Studio. We normally use the AD accounts to login into it. The AD Auth stopped working recently for all users.

We are able to access Solarwinds GUI using the same AD account and it works fine. The Auth is working for local accounts in SWQL Studio which are created inside SW but not for the AD Accounts.

The authentication is also failing for python/powershell scripts using the OrionSDK with AD accounts (all of them used to work before).

There was no upgrades performed on Solarwinds, the only change I can think of is Windows OS patching.

I have also checked the Orion.Accounts and AccountSID is not NULL.

SW Product Version: 2020.2.6

Is there anything there I can do to troubleshoot the issue?

Top Replies

Parents

0 Seashore over 1 year ago

Just one thing to make sure, if you have the latest hotfixes for Orion you also need the latest SWQL studio - do you have the latest SWQL studio?

Also, are your AD users added as groups or individual accounts? I see this behavior at other places with group accounts.
Cancel
Vote Up +1 Vote Down

Cancel
0 pramod.paul.jose over 1 year ago in reply to Seashore

We tested with latest version of SWQL and it still does not work. The API access via Python SDK is also not working for AD Group Users. So I guess the issue is not with SWQL but with Core or Information service API.

We dont use individual accounts as there is few many users who need API access. Ex: Users use scripts to mute/manage multiple nodes as part of a Change

Also noticed, when I add a new Orion local user it has only access to the Orion scheme and not to NCM, Cirrus etc. But older local accounts can access all schemas in SWQL.

Looks the whole authentication for API's seems to be mess for me. Is there a way to reset the stuff? like a clean slate and start again
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 pramod.paul.jose over 1 year ago in reply to Seashore

We tested with latest version of SWQL and it still does not work. The API access via Python SDK is also not working for AD Group Users. So I guess the issue is not with SWQL but with Core or Information service API.

We dont use individual accounts as there is few many users who need API access. Ex: Users use scripts to mute/manage multiple nodes as part of a Change

Also noticed, when I add a new Orion local user it has only access to the Orion scheme and not to NCM, Cirrus etc. But older local accounts can access all schemas in SWQL.

Looks the whole authentication for API's seems to be mess for me. Is there a way to reset the stuff? like a clean slate and start again
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 KMSigma.SWI over 1 year ago in reply to pramod.paul.jose

Wasn't there something and users SIDs being empty in the database?
Cancel
Vote Up 0 Vote Down

Cancel
0 edwinhoekman over 1 year ago in reply to KMSigma.SWI

Yes there was an issue.
See: https://thwack.solarwinds.com/product-forums/the-orion-platform/f/orion-sdk/44700/swis-swql-studio-api---windows-group-authentication-issue
Cancel
Vote Up +1 Vote Down

Cancel
0 pramod.paul.jose over 1 year ago in reply to edwinhoekman

I faced missing Account SIDs in Feb 2022 and I had around 20 users affected. It got fixed by running the powershell script that was provided in the forum.

This time it seems to be a different issue, as all AD group users are affected.
Cancel
Vote Up 0 Vote Down

Cancel
0 Martin_Crothers over 1 year ago in reply to pramod.paul.jose
Might want to check if for some reason the SID changed (i.e.: there was an AD migration of some sorts).

If the SIDs are still the same, I would try converting a user who is a member of a an affected security group:

Add the user as an individual AD account

Disable the group

If they can authenticate that way, you've at least eliminated a variable in chasing down the root cause.
Cancel
Vote Up 0 Vote Down

Cancel
0 pramod.paul.jose over 1 year ago in reply to Martin_Crothers

I got the Solarwinds Support team to confirm that this is a new bug in the recent release and they are aware of it.

We have 20+ users who need API access and hence adding them directly is not a viable solution, but a good work around.

Also, the security guidelines in the Enterprise restrict use of direct access.
Cancel
Vote Up 0 Vote Down

Cancel
0 terence.lau over 1 year ago in reply to pramod.paul.jose

Hi Pramod.Paul.Jose,

Did you manage to get any further clarity from Solarwinds Support regarding this bug?

I raised a ticket as well but got shot down by Support ...

"The Orion SDK and API use is not a component of the SolarWinds licensing model and as such, does not fall under the coverage of Technical Support."

Thanks.
Cancel
Vote Up 0 Vote Down

Cancel
0 donrobert5 over 1 year ago in reply to terence.lau

Tell them it is a core bug. JIRA Case: CORE-15843

Then refer them to this thwack link. Even though it is outside the Normal support as it is Orion SDK/API, they should have basic knowledge on what are the known bug within the product.

thwack.solarwinds.com/.../swis-swql-studio-api---windows-group-authentication-issue
Cancel
Vote Up +7 Vote Down

Cancel
0 terence.lau over 1 year ago in reply to donrobert5

I reopened my case and after several back and forth with 2 different Support engineers, especially after a lengthy speel about "caring for your paying customers" and the fact that CORE-15843 is over a year old (possibly 2 years), they've requested logs from me.

Not getting my hopes up yet but lets see how much further this goes. Cheers.
Cancel
Vote Up +1 Vote Down

Cancel
0 donrobert5 over 1 year ago in reply to terence.lau

Most probably they would be checking the SWIS logs and check the NULL value on the DB.
Cancel
Vote Up 0 Vote Down

Cancel