Installation of Scorch 2025 - problem with Orchestrator console to connect to web API

The repeated logon prompts indicate that the Orchestration Console still cannot successfully authenticate to the Web API, even though the URL now loads the login page.

Use the following checks and fixes:

1. Verify Web API URL used by the Console
   • The Console reads the Web API URL from:
     • {install_dir}\assets\configuration.json on the Orchestration Console server.
   • Open this file in a text editor and confirm:
     • The URL exactly matches the Web API endpoint (correct host and port).
     • There is no trailing / at the end of the URL.
   • If changed, save the file and restart IIS (or at least the Orchestration Console site) and reload the Console.
2. Confirm Web API URL configured at install
   • If installed via command line, confirm the values used:
     • /WebServicePort:[Port] – port for the Web API service.
     • /WebServicePublicUrl:[URL] – URL of the Web API service used by the Orchestration Console.
     • /WebConsolePublicUrl:[URL] – URL of the Orchestration Console used to configure CORS on the Web API.
   • If these do not match the actual bindings in IIS, update the configuration (Web API web.config and Console configuration.json) so they are consistent.
3. Check for CORS or authentication errors
   • In the browser, open the developer tools (Console tab) while loading the Orchestration Console.
   • If there is an error like “Uh oh! Trouble connecting to WebApi [status 0]” or blocked by CORS policy:
     • Adjust the Web API web.config CORS configuration so that the origin matches the Console URL exactly and is in lowercase, for example:

              <add allowCredentials="true" maxAge="7200" origin="http://{domain}[:{port}]">
                <allowMethods>
                  <add method="GET"/>
                  <add method="PUT"/>
                  <add method="POST"/>
                  <add method="PATCH"/>
                  <add method="DELETE"/>
                </allowMethods>
                <allowHeaders allowAllRequestedHeaders="true"/>
              </add>
       

   • If there are no CORS errors, check Event Viewer → Application on the Web API server for authentication or authorization failures.
4. Validate that the account has Orchestrator permissions
   • Ensure the account used to log on is in the group configured as the Orchestrator users group during installation (/OrchestratorUsersGroup:[Group SID] or the default local group if none was specified).
   • If the account is not in that group, add it, then sign out and sign back in to the Console.
5. Confirm network and name resolution
   • From the Console server, browse directly to the Web API URL (the same one in configuration.json).
   • If prompted repeatedly for credentials there as well, the issue is with IIS/Web API authentication or CORS configuration, not the Console itself.

If the Web API URL, CORS configuration, and Orchestrator permissions are all correct and the Web API is reachable directly in a browser without repeated prompts, the Console should stop looping on the login dialog.

References:

• Overview of the Orchestration console
• Install System Center - Orchestrator