Forbidden User Permissions Access Issue: 403 Subcodes

4/29/2020 12:46 PM

2/12/2025 5:43 AM

Utilize this directory of articles that are based around various subcodes of the 403 forbidden message. This is specifically useful in getting more information on users unable to sign in with Smart Card (CAC/PKI) user authentication. This will point the user towards troubleshooting the authentication issue internally. SolarWinds Support does not assist with Smart Card authentication implementation.

Subcodes can be determined from IIS log files. These are located on the web server (main polling engine) at the following default location.

C:\inetpub\logs\LogFiles\W3SVC1\

Orion Platform

Account permissions

403 Subcode - Forbidden

User Permission Access Issue:

• 403.1 - Execute access forbidden
• 403.2 - Read access forbidden
• 403.3 - Write access forbidden

 

If the user sees the above Error(s), Group Policy has blocked the user from accessing the System. IIS leverages the same Authenticate access as if a user was logging into the system.

1. Open up Group Policy Manager, whether on the System Directly or through Group Policy Editor
2. Go into Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\
3. Check Security Settings to ensure that accounts are not denied Login Access. IIS uses multiple Group Policy Settings to determine access. If the user does not fall into these groups, the user will be blocked access.
4. On the Solarwinds Server, Check the Security Event Log on the Solarwinds Server and the Event ID.
5. Use this Microsoft Page to identify what setting is causing the issue based on the Event ID or Message. Interactive Logon Tools and Settings: Logon and Authentication (© 2020 Microsoft, available at https://docs.microsoft.com/en-us/, obtained on April 29, 2020)

 

User connected via http://, change to https://

• 403.4 - SSL required

 

SSL Setting is set to Required see Setup SSL and Enable Smart Card (CAC/PKI) User Authentication for Orion 2017.1+  

• 403.7 - Client certificate required. This error message is received if a client does not provide a client certificate when one is required. Either the client refused to send a client certificate or the client did not have a certificate issued by a mutually trusted certification authority.

                   See Also: https://blogs.msdn.microsoft.com/friis/2011/11/15/troubleshooting-403-7-client-certificate-required-... (© 2020 Microsoft, available at https://blogs.msdn.microsoft.com, obtained on April 29, 2020)

• 403.13 - Client certificate revoked. This error message means that the client sent a certificate, but either the certificate shows up as revoked in the issuing authority's Certificate Revocation List or the server could not retrieve a CRL from the issuing authority.
  • https://support.microsoft.com/en-us/help/294305 (© 2020 Microsoft, available at https://support.microsoft.com/en-us/, obtained on April 29, 2020)
• 403.16 - Client certificate is untrusted or invalid. Primarily generated when client certificate provided is improperly formed. It can also occur if the Intermediate Certification Authorities in the certificate chain is not trusted by the Web server. It can also occur if the Trusted Root Certification Authorities certificate store contains non-self-signed certificates. See the link below. 
  • https://support.microsoft.com/en-us/help/942061 (© 2020 Microsoft, available at https://support.microsoft.com/en-us/, obtained on April 29, 2020)
• 403.17 - Client certificate has expired or is not yet valid. The current date on the server is not within the valid date ranges that are presented in the client certificate. 
  • https://support.microsoft.com/en-us/help/248031 (© 2020 Microsoft, available at https://support.microsoft.com/en-us/, obtained on April 29, 2020)