HTTP 403 “You don’t have user rights to view this page” after enabling CAC authentication for SolarWinds Web Console

3/10/2026 9:01 PM

3/10/2026 9:01 PM

In environments using Smart Card / CAC (PKI) authentication for the SolarWinds Web Console, users may see:

“You don’t have user rights to view this page.”
HTTP Error 403 – Forbidden

immediately after selecting their CAC certificate and entering their PIN. The browser prompts for the certificate, but access is denied before the SolarWinds Platform login page loads.

This article describes a case where the issue was resolved by cleaning up incorrect trusted authentication certificates on the SolarWinds server and enabling Windows login in Web Console Settings.

Network Performance Monitor

1. Incorrect / stale certificates in the trusted authentication certificate store on the SolarWinds server

   • Extra or outdated certificates in the trusted authentication / trusted issuer store caused IIS to treat the client certificate chain as invalid or untrusted.

   • As a result, IIS rejected the CAC client certificate during TLS negotiation, returning HTTP 403 before the SolarWinds Platform could evaluate the user.

2. Web Console not configured to accept Windows-authenticated users

   • In Web Console Settings, Windows Account Login was not enabled.

   • After IIS successfully authenticates the client certificate and maps it to a Windows/AD identity, the SolarWinds Platform must be configured to accept Windows login; otherwise the authenticated user is not recognized correctly.

Together, these resulted in IIS blocking the request at the SSL/client-cert stage and producing the “You don’t have user rights to view this page” 403 error.

1. Clean up trusted authentication certificates on the SolarWinds server

On the SolarWinds application server:

1. Open MMC as an administrator.

2. Add the Certificates snap-in for Computer account → Local computer.

3. Review the relevant trusted certificate stores used for client certificate authentication, for example:

   • Trusted Root Certification Authorities

   • Intermediate Certification Authorities

   • Trusted People / Trusted Issuers / Trusted Authentication (as applicable in your environment)

4. Identify and remove:

   • Stale, deprecated, or incorrect trusted authentication / issuer certificates that should no longer be used for CAC/PKI validation.

   • Any test or self-signed certificates that might cause IIS to prefer an invalid chain for the client certificate.

5. Ensure that only the correct organization PKI root and intermediate CAs (and any required issuing CAs) remain in the trusted stores.

6. After adjusting certificates, restart:

   • IIS (e.g., iisreset), and

   • SolarWinds services (or run the SolarWinds Platform Service Manager and restart “Everything”) if needed.

Note: Exactly which certificates need to be removed/kept is environment-specific and must be determined by the customer’s PKI/security team.

---

2. Enable Windows login in Web Console Settings

Once the certificate stores are corrected and CAC authentication is working at IIS level, configure the Web Console to accept Windows-authenticated users:

1. Log in to the Web Console using an account that can still authenticate (for example, a local SolarWinds Platform admin or known working AD account, as appropriate for the environment).

2. Navigate to:
   Settings → All Settings → Web Console Settings

3. Under Windows Account Login, set:

   • Windows Account Login: Enable Automatic Login (or “Enable Windows login” depending on version wording).

4. Click Submit to save changes.

This ensures that when IIS authenticates a user via CAC and maps them to a Windows/AD identity, the SolarWinds Platform will automatically log that user into the Web Console, assuming:

• Their AD account (or an AD group they belong to) has been added in Settings → All Settings → Manage Accounts, and

• They have the required SolarWinds Platform role permissions.

---

3. Verify access

After applying the above changes:

1. Close all browser windows and clear SSL/TLS sessions (or test from a fresh client).

2. Browse to the SolarWinds Web Console using the HTTPS URL that matches the certificate CN/SAN.

3. When prompted, select the CAC certificate and enter the PIN.

4. Confirm that:

   • The 403 “You don’t have user rights to view this page” error no longer appears, and

   • The user is successfully logged into the Web Console.