You cannot access the System Center 2012 Operations Manager AppAdvisor website when you use Kerberos authentication

Article ID: 2872367 - View products that this article applies to.
Expand all | Collapse all

Symptoms

Consider the following scenario:
  • You are using Microsoft System Center 2012 Operations Manager.
  • The Application Advisor (AppAdvisor) console is installed on a different computer than the server that is running the SQL reporting services or the server that is hosting the OperationsManagerDW database.
  • You are using Kerberos authentication to access AppAdvisor.
In this scenario, you cannot access AppAdvisor as expected.

Cause

This behavior may occur because of an increase in the number of authentication hops that are required.

Workaround

To work around this behavior, configure AppAdvisor to use forms-based authentication. This configuration generates a dialog box in which the user can enter credentials.

Status

Microsoft has confirmed that this is expected behavior in the Microsoft products that are listed in the "Applies to" section.

More information

If you are a member of the Operations Manager Application Monitoring Operator role, the user account must be authenticated when you access AppAdvisor. This is so that the user account can be checked against the System Center data access service in order to grant access to AppAdvisor.

AppAdvisor acts as a proxy between SQL Server Reporting Services (SSRS) and the front-end server that lets you select certain reports and their parameters. The SQL reporting services have their own authentication model. This model is changed by System Center – Operations Manager during reporting installation. This change introduces an additional hop in the authentication process.

The identity flow for AppAdvisor is as follows.
  • From browser to website: The website performs an initial check of the user's identity to determine whether the user is granted access. This check is performed against the System Center data access service.
  • From website to SSRS: The user's identity must be forwarded to SSRS because Operations Manager uses SSRS to enforce a separate identify and authorization check against the System Center Data Access service.
  • From SSRS to the OperationsManagerDW database: This step uses the SSRS AppPool credentials.
Because of the additional authentication hop that occurs, Windows authentication may not work in this scenario. This behavior is partly affected by the web console and whether the SSRS websites are hosted on the same server. You can use forms-based authentication in a distributed environment to help restore access to AppAdvisor.

References

For more information about the identity flow for AppAdvisor, go to the following Systems Center – Operations Manager forum website:

Identity flow for AppAdvisor and AppDiagnostics

Properties

Article ID: 2872367 - Last Review: August 15, 2013 - Revision: 1.0
Applies to
  • Microsoft System Center 2012 Operations Manager Service Pack 1
  • Microsoft System Center 2012 Operations Manager
Keywords: 
KB2872367

Give Feedback

 

Contact us for more help

Contact us for more help
Connect with Answer Desk for expert help.
Get more support from smallbusiness.support.microsoft.com