Makes me think of the scene from Airplane with the AutoPilot blow-up, similarly parallel to engineer experiences talking about the SCOM Web Console configuration.  I’m ready to dispel some myths to document securing the ‘SCOM Web Console for authentication’

Quick outline

Knowledge Articles to aid with ‘SCOM WebConsole settings for authentication’

Configuring SSL certs and Smart Cards (this post)

Configuring Kerberos and AD delegation (next post)

Verifying WebConsole functionality blog posts – ReDirect, Authentication, SSL and Bindings

Mitigating SCOM vulnerabilities – Java, HSTS, ODBC

Knowledge Articles

How to Install Web Console from learn.microsoft.com for SCOM 2019, 2022

Holman’s SCOM quick start install guides for SCOM 2019, 2022

IIS Manager Authentication from learn.microsoft.com

Configuring SSL Certs and Smart Cards

Setup ‘SCOM WebConsole settings for secure authentication’, access, and rendering methods.  I’ve setup the web console role with defaults, then come back later.  Holman’s quick start lets you complete the role with default HTTP setup.  After that, we add an SSL cert for HTTPS.  Thirdly, employ aliases, or F5 load balancers to simplify user experience accessing the console.  Fourth, setup SmartCards to help secure, also Kerberos authentication/delegation. 

Part 1 – Start with the SSL certificate for https

Setup the ‘SCOM WebConsole settings for authentication’, beginning with a SSL certificate request for the server(s) in question.  Add any SAN names/aliases you want (if not load balanced).

NOTE:

Use CA Auto-Enrollment templates to simplify SSL request whenever an internal or external SSL certificate is required for your organization.  Generally, external certificates require manual effort executing the certreq script.

Sample SSL certificate

Less typing means less typos

Below SSL certificate example with any SAN names/aliases (if not load balanced).  Simplify the SCOM web console link to https://SCOM/ versus https://SCOMSERVERName/OperationsManager

Part 2 – Add authentication Smart Card in IIS

Next! – I will set up SmartCard role in ‘SCOM WebConsole settings for authentication’.  Additionally, review the Learn.microsoft.com site for IIS here.

Compatibility

Add the Client Certificate feature for the SCOM Web Console

Let’s add SmartCard authentication capability.

Open Server manager >

Click on Manage > Add roles/features (top right)

Click Next twice to get to the Server Roles

Server Manager > Server Roles tab output

Expand Web Server drop down

SCOM Web Console Authentication installing Client Certificate Mapping role

Click the box to check ‘Client Certificate Mapping Authentication (Installed)’ and click Next twice (2) [ two times ]

Expand Server Manager > Web Server > Client Certificate Mapping Authentication

Click Install (mine is greyed out as it’s enabled)

Allow install to complete, server will prompt if reboot required.

NOTE: Either way, reboot is required to apply new authentication method.

Validate IISManager after reboot

Click on Authentication to verify ‘Active Directory Client Certificate Authentication’ is present and enabled.

After reboot, verify ‘AD Client Certificate authentication’ method is enabled and visible.

From IISManager > Server > Authentication > Verify method is there and enabled

Verify Default Web Site Authentication setup

Verify Default Web site has Windows Authentication enabled.

Navigation steps:

IIS Manager > Expand Sites > Default Web Site > Authentication

Windows Authentication should be enabled, others disabled