Network Management

SWQL Studio authentication in SAML- only SolarWinds environments

When the SolarWinds Platform is configured for SAML-only authentication and all local/Windows/AD accounts are disabled, SWQL Studio cannot authenticate using SAML. In this configuration, login attempts from SWQL Studio fail with errors such as “User account is disabled” or certificate/endpoint errors, depending on the selected server type.

First published date

3/2/2026 7:19 PM

Last published date

3/2/2026 7:19 PM

Overview

In a SAML-only environment, attempts to connect SWQL Studio to the SolarWinds Information Service (SWIS) fail regardless of the selected Server Type: 

The following behavior is observed: 

 

  • Server Type: Orion (V3) AD → “User account is disabled.”

  • Server Type: Orion (V3) → “Unable to connect to Information Service. User account is disabled.” 

    Server Type: Orion (V3) Certificate → “No certificate with subject name <SolarWinds-Orion> found.”

    Server Type: Orion (V3) over HTTPS / HTTPS legacy → Certificate name/chain mismatch warning; 

     

     

        Followed by authentication/endpoint errors after continuing. 

        The environment uses SAML groups for access and does not have any active SolarWinds Platform local or AD accounts that SWQL Studio can use. 

        Product section

        Orion Platform

        Cause

        SWQL Studio authenticates to SWIS using non-SAML mechanisms (SolarWinds Platform local accounts, Windows/AD credentials, or certificates). 
         

        SAML SSO is implemented at the web tier, not as a direct authentication method for SWIS/SWQL Studio. 
         

        In a SAML-only deployment where all SolarWinds Platform/Windows/AD user accounts are disabled, SWQL Studio has no valid identity it can use, so authentication fails with “User account is disabled” and related errors. 

        This is product behavior / limitation:  SWQL Studio does not currently support direct SAML-based authentication to SWIS. 

        Resolution

         

        Use a dedicated non-SAML service account:

        To use SWQL Studio in a SAML-only environment, create (or re-enable) a dedicated least-privilege account that authenticates via a supported method (SolarWinds Platform local or AD), and use that account in SWQL Studio: 

        • Create a dedicated SWQL/API account in the SolarWinds Platform:

          • Either a SolarWinds Platform local account or an Active Directory account/group.

          • Do not disable this account as part of the SAML-only policy.

          • Assign minimum required permissions, typically: Read-only access to the objects the user needs for reports, alerts, or widgets. 
             

        • In SWQL Studio:

          • Set Server Type to Orion (V3) or Orion (V3) over HTTPS according to your deployment.

          • Enter the hostname and port for your SolarWinds Platform server.

          • Authenticate using the dedicated Orion/AD account credentials. 

        This allows SWQL Studio to authenticate through the supported non-SAML path while keeping user interactive access via SAML in the web console.