SWIS / SWQL Studio / API - Windows Group Authentication Issue

Run sql query SELECT AccountID, AccountSID FROM [DATABASE].[dbo].[Accounts] WHERE AccountID='DOMAIN\ACCOUNT'.
Replace DATABASE and DOMAIN\ACCOUNT with corresponding ones for you.

If you got NULL AccountSID, just update the value with the proper SID for your account. 

Fixed for us this exact issue. I'm curios if this helps others and amazed how this does not have an answer yet being opened since more than 1 year

In my case, when I run the query the SID is populated with the correct SID.  I'm still at a loss here as to why I'm getting an authentication error.  I log into the web GUI everyday, my account is an AD account under a Windows Group that has admin rights.  

Hi @Tordormore,
Is it effecting your with SWQL studio only, or also with using CURL/PowerShell module/Python module?

Hi @Tordormore,
Is it effecting your with SWQL studio only, or also with using CURL/PowerShell module/Python module?

That's a good question.  Just digging in, so I've only tried SWQL studio at this point.  I'm installing the PowerShell module now to try it.

I'm getting the same error when attempting to use the PowerShell module.  

Would you be able to share a picture of the error you're getting (just blur/cover any identifying data that may occur)?

Which "Server Type" are you using in SWQL studio?  I'm also authenticating with an AD Security Group.  I use "Orion (v3)" as my server type, and am able to both include or exclude the domain when entering my username.

Concerning the SSL certificate for your system: are you using the self-signed cert, or do you have a cert generated by a CA?  I found that I ran into problems with the API when testing with the self-signed cert (probably due to a security configuration on my companies laptop).  I also once encountered a time mismatch between my computer and the server running Orion that caused a connection issue.

I'll answer your questions in reverse order.  We have a central PKI internally and both my laptop and the server are using certs issued from a CA in that environment.  All CA's are signed by the root (which is offline until sub-CA renewals).  I am using "Orion (v3)" as my server type in SWQL Studio.  Good to know you can include or exclude domain, I have attempted both ways.  

BTW, I just created a local test account (non-AD) and was able to authenticate with SWQL Studio.  So it seems to be an AD authentication issue.

Hmm, was just about to suggest that as a test.  This will go beyond my ability.  Perhaps dan_jagnow or KMSigma.SWI will know better.  At this point I would be second guessing my edit of the SID and would try it again (just to make sure I didn't accidentally inject a non-printing character).

Thanks, I didn't have to edit any SID's because the SID was already populated.  

Right, sorry, forgot that part.  I guess I might try changing it anyway, just throwing things at the wall at that point.

When I've had to do it, I'll use this PowerShell one-liner to get the SID:

(Get-ADUser -Identity 'YourAccountID').SID.Value

CORE-15843 is still unresolved at this point.  I've added some notes on the issue.