Ron Hagerman

21 Jul 2010 10:05 PM

Hi Kevin,

I followed your instructions but the problem I had with my Windows 2008 R2 web server is that I am forbidden to allow any service to delegate for security reasons.

I thought for sure I was hosed and was preparing to open a support case when I thought about the identity of my IIS server. I have the SPN set up and delegation configured per your Windows 2003 instructions and then I set the application pool identity to LocalSystem. This resolved my problem. Now I can comply with company security guidelines and still offer the SCOM web console to my end users.

Thanks for the great post!

Ron Hagerman

The Boeing Company

Robert Posey

7 Sep 2010 5:47 PM

You Rock. That fixed it! Thank you!

Murad Akram

17 Sep 2010 7:55 PM

kevin, I've tried everything listed/documented/recommended in this post, but I am unable to get my Ops Web Console working on a non-RMS server using integrated windown auth. So at this point I like to remove the Web Console from my MS (Management Server) and install it on my RMS cluster (2 node). Have you installed Web Console on a cluster, is it even supported?, can it be done? would I just use a generic service option to cluster IIS 7.0?

Please Advice

Murad

Murad Akram

17 Sep 2010 7:58 PM

Oh by the way I am using SCOM 2007 R2 with Cum1 patch and all my servers are running Windows Server 2008 edition.

Kevin Holman

17 Sep 2010 8:06 PM

Murad - I dont recommend installing the web console in a RMS cluster - I am pretty sure that is an untested/unsupported configuration. It might be able to be done... but IIS can use considerable resources on a RMS.

I have moved to recommending installing the web console as forms based auth for NON-RMS installs - because of the trouble getting this to work can be.

Help me understand - what is the big deal with having Windows auth for customers? Is having to type in a username and password in a form THAT big of a deal?

Murad Akram

17 Sep 2010 9:06 PM

Kevin,

I am pretty sure it's not going to be a big deal if I ask my internal customers/users to login to the web console every tme they need to acces the alert view or Dashboard view etc. It was my personal preference to make things easier for the user community. The only issue I can see with enabling forms based auth is that we have/use multiple domain user IDs (one to access our PCs and the other "SA" to do windows server administration realted tasks) so they might get confused (initially) as to what ID they need to use to access the console.

Also, it is heard for me to believe that I am being forced to implement form based auth solution. What if the Ops Web Console is very important to us and we like to seperate it from the RMS and MS server and like to host it in a web farm with hardware based load balancing (i.e.f5) I guess we will have the same issues there?

Murad

Jimmy

16 Nov 2010 8:25 PM

Kevin,

I just moved my web console from my RMS (Windows 2008) to a secondary management server (Windows 2008 R2) following this guide and everything worked perfect. Thanks alot. This blog has helped me out numerous times.

You Da Man!

-Jimmy

Joe Thompson

18 Sep 2011 5:06 PM

Kevin,

I had a DEV environment that had no issues running the Webconsole, but my PROD environment would work off and on. Finally worked with Microsoft IIS Support and got it working using the DelegConfig utility. You basically copy the Kerberos folder to your Webconsole IIS server wwwroot, make it an Application, then browse to the Kerberos application using http://<servername>/kerberos. Do not make the mistake of browsing to it using the IIS Manager, as it uses Localhost and will not give you the information you need. After than, you can review the report and any kerberos and delegation issues. You can run through its wizard and setup the triple hop you need to make it to your RMS and then DBS. Once done, it will give you the proper SETSPN commands you need to make it all work.

In my instance, I had a duplicate SPN for the RMS service account that was preventing it from working consistantly. In our environment, only Domain admins have the permissions to create SPN's so when I did the OPSMAN 2007 setup, the SPN's were not automatically created...

Hope this helps someone else!

Good Luck!

Joe Thompson