Authorization Failed

Issue

You can't login to the Real-Time Console in a ControlUp On-Premises (COP) mode
environment, and you receive the following 'Authorization Failed" error message:

Solution 1

1. First, try the troubleshooting steps here.
2. If after you check all the steps in the article above you still can't log in to the console, check the User Management log on the COP Server in the following location:
   C:\Program Files\Smart-X\ControlUp Server\WebApps\UserManagementService\7_WS\UserManagementService.log
3. Check the errors at the bottom of the log. If you see the group "ControlUp_PrivateCloudMembers" listed, then the issue is that your service account is unable to read the contents of the file C:\Program Files\Smart-X\ControlUp Server\Server Settings\ControlUpServerSettings.xml
4. To resolve, make sure that your ControlUp service account has Read & Execute permissions for the ControlUpServerSetting.xml that defines the ControlUp User group, then perform an IISRESET.

Solution 2

If the solution above doesn't work, the root cause might be that the password for the two service accounts required to run the ControlUp services expired, so Active Directory (AD) won't let them run the services.

To verify if this is the case, try to restart the ControlUp services. If they don't restart:

1. On the COP Server machine, open Task Manager > Services, and check the status of the ControlUp-LDS or ADAM_ControlUp-LDS services:
2. To receive more details about the failure, check the user management log on the COP Server under C:\Program Files\Smart-X\ControlUp Server\Websites\UserManagementService\7_WS\user management.log

If the log contains the following errors, the issue could be with the AD group assigned to users who can login to the console:

• "ERROR|Error in BaseResponse."
• "UserManagement.Exceptions.UserManagementException: Failed to bind to organization permissions group 'AD Group Name"

To resolve, verify the following:

• The AD group and Security Identifier (SID) must match in the server settings file under C:\Program Files\Smart-X\ControlUp Server\Server Settings\ControlUpServerSettings.xml
• The AD group must be a Security Global group.
• If all application pools are running, perform an IISRESET on the COP Server.
• For versions lower than 7.2, it could be a license issue (IOP Allowed - Yes/No).

To get the SID, see here for additional information.