RE: SSO Setup Issue - Error

Using qsh, you can see all your principals in your keytab file.

kinit -k

Then you can verify your config by running the below for one of your principals.
The domain is case sensitive.
Should return only a $ if working properly.

kinit -k krbsvr400/FQCN@domain
$

Paul

-----Original Message-----
From: MIDRANGE-L <midrange-l-bounces@xxxxxxxxxxxxxxxxxx> On Behalf Of Don Brown via MIDRANGE-L
Sent: Tuesday, July 20, 2021 2:21 AM
To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxxxxxxxx>
Cc: Don Brown <DBrown@xxxxxxxxxx>; MIDRANGE-L <midrange-l-bounces@xxxxxxxxxxxxxxxxxx>
Subject: Re: SSO Setup Issue - Error

________________________________
CAUTION: This email originated from outside of the PENCOR network. Do not click on any links or open attachments unless the sender is known, and the content is verified as safe.
________________________________

I did find in the service logs the following informaiton


# WARNING# 2021/07/20 14:02:04.668 AEST# Thread: 67# com.ibm.iaccess.base.AcsSystemConfig.getAuthKerberos
(AcsSystemConfig.java:1983) [/4.dat]
SNAP **** Exception!
SNAP class com.ibm.as400.access.AS400SecurityException: Kerberos
service ticket could not be retrieved.

SNAP Caused by: class org.ietf.jgss.GSSException: Failure unspecified
at GSS-API level (Mechanism level: 80090303=InitializeSecurityContext()
len=16384 ctx=00000000 SEC_E_TARGET_UNKNOWN) SNAP

Which indicates it could not obtain a service ticket but I can find anything meaningful as to why .

Don



From: "Don Brown via MIDRANGE-L" <midrange-l@xxxxxxxxxxxxxxxxxx>
To: midrange-l@xxxxxxxxxxxxxxxxxx
Cc: "Don Brown" <DBrown@xxxxxxxxxx>
Date: 20/07/2021 04:02 PM
Subject: SSO Setup Issue - Error
Sent by: "MIDRANGE-L" <midrange-l-bounces@xxxxxxxxxxxxxxxxxx>



I am trying to set up SSO on a V7R3 IBMi

The box does not have support - it is only used for testing and is being decommissioned

This is just a proof of concept / test for SSO

I have followed the document
https://www.ibm.com/support/pages/how-configure-eim-and-nas-using-ibm-navigator-i



All the verification has succeeded but when I try to log on using kerberos

authentication I get the error;

MSGKRB001 - Kerberos error for system <ip-address> (Failure unspecified at GSS-API level (Mechanism
level:80090303=InitiateSecurityContext() len=16384 ctx=00000000
SEC_E_TARGET_UNKNOWN))

Can anyone point me in the right direction to understand / resolve this issue.

Thank you in advance.

Don


--
This email has been scanned for computer viruses. Although MSD has taken reasonable precautions to ensure no viruses are present in this email, MSD cannot accept responsibility for any loss or damage arising from the use of this email or attachments..
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related questions.

Help support midrange.com by shopping at amazon.com with our affiliate
link: https://amazon.midrange.com




--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related questions.

Help support midrange.com by shopping at amazon.com with our affiliate link: https://amazon.midrange.com