This article describes how to troubleshoot the Smart Card Authentication and login issues like 403 forbidden. The error message could be different for each environment but the above error is the most common error message customers receive. 

Review the prerequisites and complete the steps for your Orion Platform version.

• Prerequisites
• Enable Smart Card user authentication on SolarWinds Platform 2020.2 and later
• Troubleshooting

Prerequisites 

Before you start the configuration steps in the next sections, verify that you have the following set up:

• Add at least one Active Directory account to the Web Console. When all steps are enabled, the Admin account will not be able to log in.
• Under IIS bindings, it is recommended to enable "Disable TLS 1.3 over TCP".  If this is not possible, please open a SolarWinds Support Case.
• Automatic Logon is enabled, or you run through the Setup Configuration Wizard for the next steps.
• SolarWinds Web Console is configured to use SSL. See Configure the SolarWinds Web Console to use SSL.

SolarWinds Platform 2020.2 and later

Step 1: Install Client Certificate Mapping Authentication Plugin for IIS

1. Open the Windows Server Manager Console.
2. Go to Manage > Add roles and features.
3. Click the Next button go to the Server Roles tab.
4. Expand Web server IIS > Web Server > Security.
5. Select Client Certificate Mapping Authentication.
   
   (Screenshots property of © 2020 Microsoft)
6.  Finish Add Roles and Features Wizard.

Step 2: Secure the Site for Smart Card Authentication Access

1. Go to the Internet Information Service (IIS) Manager.
2. Click to the IIS server in the left tree.
3. Under IIS click Authentication.
    
   (Screenshots property of © 2020 Microsoft)
4. Enable Active Directory Client Certificate Authentication.
5. Disable the rest of the authentication types.
    
   (Screenshots property of © 2020 Microsoft)
6. Expand the Sites folder to SolarWinds NetPerfMon.
7. Under IIS, select Authentication. 
   
   (Screenshots property of © 2020 Microsoft)
8. Disable all types of authentication.
9. Click the back button on the top of the screen to return to the SolarWinds NetPerfMon Home view.
10. Click SSL or SSL Settings. 
    
    (Screenshots property of © 2020 Microsoft)
11. On SSL Settings, select Require SSL.
12. Select Required under Client Certificates.
    Note: This setting might cause issues with scheduled reports. See ExportToPdfCmd.exe can now be used with certificated-based authentication or Create a dedicated report scheduler website for use in a CAC card environment to resolve these.
13.  Click Apply in Action panel.
    
    (Screenshots property of © 2020 Microsoft)
    
    Your SolarWinds Platform is now ready for smart card authentication.

Troubleshoot Issues

• Invalid certificate errors
• Configuration Wizard Reports Web Request for /Orion/Login.aspx failed
• SSL Certificate Friendly name not matching the URL
• Users cannot select the certificate
• Everyone else can log in except for a few users
• The User is required Interactive Logon for this system
• Active Directory Users cannot authenticate
• Orion Web Console returns 401

Invalid certificate 'Error: "Subject Alternative Name Missing" or NET::ERR_CERT_COMMON_NAME_INVALID or "Your connection is not private"'

If your certificate is identified as invalid by your browser, the certificate does not contain a SAN (Subject Alternative Name) extension in form of DnsName=OrionDomainName. See section 'Error: "Subject Alternative Name Missing" or NET::ERR_CERT_COMMON_NAME_INVALID or "Your connection is not private " (© 2020 Google, available at support.google.com, obtained on June 30, 2020).
 

Configuration Wizard Reports Web Request for /Orion/Login.aspx failed

When the Configuration Wizard erroneously reports Web Request for /Orion/Login.aspx failed, ignore this message in Configuration Wizard, it still works. This is due to the Authentication and SSL change in the setup.

To resolve the issue:

1. Go into C:\ProgramData\SolarWinds\Logs\Orion\ConfigurationWizard.log.
2. Search for Web Request for /Orion/Login.aspx failed. The same line may report No connection could be made because the target machine actively refused it 127.0.0.1:80. This means that Port 80 HTTP is not available.
3. Enable Port 80 HTTP to have this error disappear.

SSL Certificate Friendly name not matching the URL

• The following problems are all related to the SSL Certificate Friendly Name not matching the URL, or there is no CA trust. Re-create the certificate to match the URL that all users will be connecting.

  • Internet Explorer: Red X, There is a problem with this website’s security certificate

  • Google Chrome: "Your Connection is not private" message

  • Firefox: Untrusted Connection or Your Connection is Untrusted

• If the SSL Certificate shows as invalid or has a Red X, Export to PDF and Reports may not function correctly. Friendly Name needs to match URL.

Users cannot select the certificate

If the user cannot select the Certificate or it does not prompt, it is due to browser settings.

Internet Explorer

1. Select the Alt Key to bring up the Menu (IE 10 and newer), then select File> Properties.
2. Look for Zone, this is needed for Step 5.
3. Select the gear or Settings> Internet Options.
4. Select the Security Tab.
5. Select the Zone that was seen in Step 2 and select Custom Level. You can promote the site to Trusted for better security.

   1. Select Close.

   2. Select Add.

   3. Select Sites.

   4. Select Trusted Sites.

6. Scroll to the bottom, the last option is User Authentication.

   1. If the User only has 1 certificate and wants it auto-selected (this will log in the account that they are logged on the OS with), select Automatic Logon with the current user name and password

   2. If the User wants to select and have a choice for certificates, select Prompt for User name and Password

7. Refresh or restart the browser. You may need to clear the cache for the change to take effect.

Mozilla Firefox (only needed if it fails)

1. In the Firefox address bar, enter about:config.
2. In the Filter field, enter network.automatic-ntlm-auth.trusted-uris.
3. Double-click the Preference Name listed (network.automatic-ntlm-auth.trusted-uris)
4. In the Enter string value window, enter a comma-separated list of the URLs of the Orion Web Consoles to which you want to enable AD access, as shown in the following:
   https://OrionServer1,http://OrionServer2,https://OrionWANMonitor
5. Click OK.
   Note: You may need to restart Firefox for this configuration to take effect.

Everyone else can log in except for a few users

If the user sees the following error, Group Policy has blocked the user from accessing the System. IIS leverages the same Authenticate access as if a user was logging into the system.
 

The User is required Interactive Logon for this system

1. Open up Group Policy Manager, whether on the System Directly or through GPO.
2. Go to Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\
3. Check Security Settings to ensure that accounts are not denied Login Access.
4. Other Interactive Login Errors can be referenced back to the Event Log on the Solarwinds Server and the Event ID. Use this Microsoft Page to identify what setting is causing the issue based on the Event ID or Message. Interactive Logon Tools and Settings: Logon and Authentication. (© 2016 Microsoft, available at https://technet.microsoft.com/en-us, obtained on October 28, 2015.)

• If you are prompted for your account username and password after entering your pin, enable Windows Account Automatic Logon. Go to Settings > Web Console Settings > Windows Account Login set to Enable Automatic Login and Select Submit at the bottom. If you repeat this step after running the Configuration Wizard, follow the steps under Setup Configuration Wizard for the next use.

Active Directory Users who have not yet signed into the web console, but belong to a valid active directory group within Orion, cannot authenticate

• RDP to Orion Server > Open IIS Manager > Under the 'Site' > Click 'Authentication' and ensure the following settings are in place:
  • Anonymous Authentication [Enabled]
  • ASP .NET Impersonation [Disabled]
  • Forms Authentication [Enabled]
  • Windows Authentication or CAC [Enabled]
• Make sure Pass-Thru authentication is also enabled (Option during Configuration Wizard to automatically login).
• This article helps you resolve the problem where Internet Information Services (IIS) 8 may reject client certificate requests with HTTP 403.7 or 403.16 errors (© 2022 Microsoft, available at https://docs.microsoft.com, obtained on March 2, 2022).