Thanks Paul,
Yes the kinit does succeed
As far as folowing the set up document goes everything that has a way to
verify has passed / succeeded.
It is the final step where I set the iACS connection to kerberos and try
and connect when I get the error.
Any suggestions on how to identify the error ?
Thanks
Don
From: "Steinmetz, Paul" <PSteinmetz@xxxxxxxxxx>
To: "'Midrange Systems Technical Discussion'"
<midrange-l@xxxxxxxxxxxxxxxxxx>
Cc: "Don Brown" <DBrown@xxxxxxxxxx>, "MIDRANGE-L"
<midrange-l-bounces@xxxxxxxxxxxxxxxxxx>
Date: 20/07/2021 10:47 PM
Subject: RE: SSO Setup Issue - Error
Using qsh, you can see all your principals in your keytab file.
kinit -k
Then you can verify your config by running the below for one of your
principals.
The domain is case sensitive.
Should return only a $ if working properly.
kinit -k krbsvr400/FQCN@domain
$
Paul
-----Original Message-----
From: MIDRANGE-L <midrange-l-bounces@xxxxxxxxxxxxxxxxxx> On Behalf Of Don
Brown via MIDRANGE-L
Sent: Tuesday, July 20, 2021 2:21 AM
To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxxxxxxxx>
Cc: Don Brown <DBrown@xxxxxxxxxx>; MIDRANGE-L
<midrange-l-bounces@xxxxxxxxxxxxxxxxxx>
Subject: Re: SSO Setup Issue - Error
________________________________
CAUTION: This email originated from outside of the PENCOR network. Do not
click on any links or open attachments unless the sender is known, and the
content is verified as safe.
________________________________
I did find in the service logs the following informaiton
# WARNING# 2021/07/20 14:02:04.668 AEST# Thread: 67#
com.ibm.iaccess.base.AcsSystemConfig.getAuthKerberos
(AcsSystemConfig.java:1983) [/4.dat]
SNAP **** Exception!
SNAP class com.ibm.as400.access.AS400SecurityException: Kerberos
service ticket could not be retrieved.
SNAP Caused by: class org.ietf.jgss.GSSException: Failure unspecified
at GSS-API level (Mechanism level: 80090303=InitializeSecurityContext()
len=16384 ctx=00000000 SEC_E_TARGET_UNKNOWN) SNAP
Which indicates it could not obtain a service ticket but I can find
anything meaningful as to why .
Don
From: "Don Brown via MIDRANGE-L" <midrange-l@xxxxxxxxxxxxxxxxxx>
To: midrange-l@xxxxxxxxxxxxxxxxxx
Cc: "Don Brown" <DBrown@xxxxxxxxxx>
Date: 20/07/2021 04:02 PM
Subject: SSO Setup Issue - Error
Sent by: "MIDRANGE-L" <midrange-l-bounces@xxxxxxxxxxxxxxxxxx>
I am trying to set up SSO on a V7R3 IBMi
The box does not have support - it is only used for testing and is being
decommissioned
This is just a proof of concept / test for SSO
I have followed the document
https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ibm.com_support_pages_how-2Dconfigure-2Deim-2Dand-2Dnas-2Dusing-2Dibm-2Dnavigator-2Di&d=DwIFAg&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=x3rBwxMTlO3UcnVchBJYlkqPD8BpO91HbuZYQ_ZepUs&m=Ab2mGfNvVyI4ehCNV5JKQWPeSfKRBgCvGNAQ4IV6faU&s=2dhvygJJXJbcJauI0JqOMWt_8w_V5WKIPhHT4_kXwdU&e=
All the verification has succeeded but when I try to log on using kerberos
authentication I get the error;
MSGKRB001 - Kerberos error for system <ip-address> (Failure unspecified
at GSS-API level (Mechanism
level:80090303=InitiateSecurityContext() len=16384 ctx=00000000
SEC_E_TARGET_UNKNOWN))
Can anyone point me in the right direction to understand / resolve this
issue.
Thank you in advance.
Don
--
This email has been scanned for computer viruses. Although MSD has taken
reasonable precautions to ensure no viruses are present in this email, MSD
cannot accept responsibility for any loss or damage arising from the use
of this email or attachments..
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx To subscribe,
unsubscribe, or change list options,
visit:
https://urldefense.proofpoint.com/v2/url?u=https-3A__lists.midrange.com_mailman_listinfo_midrange-2Dl&d=DwIFAg&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=x3rBwxMTlO3UcnVchBJYlkqPD8BpO91HbuZYQ_ZepUs&m=Ab2mGfNvVyI4ehCNV5JKQWPeSfKRBgCvGNAQ4IV6faU&s=augqYrCJFn0diFdjH_NgIEs7eDxLkAznf3i27bPFj-o&e=
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives at
https://urldefense.proofpoint.com/v2/url?u=https-3A__archive.midrange.com_midrange-2Dl&d=DwIFAg&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=x3rBwxMTlO3UcnVchBJYlkqPD8BpO91HbuZYQ_ZepUs&m=Ab2mGfNvVyI4ehCNV5JKQWPeSfKRBgCvGNAQ4IV6faU&s=mfDCf8WXAR5eKTnJ9gLW7tkJMv3WOZ-izpx_ZlaY3Vg&e=
.
Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related
questions.
Help support
https://urldefense.proofpoint.com/v2/url?u=http-3A__midrange.com&d=DwIFAg&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=x3rBwxMTlO3UcnVchBJYlkqPD8BpO91HbuZYQ_ZepUs&m=Ab2mGfNvVyI4ehCNV5JKQWPeSfKRBgCvGNAQ4IV6faU&s=hTU-0LdmeG_7MrqM6shHg-VymfqINeqAUZeLKBO9T3Y&e=
by shopping at
https://urldefense.proofpoint.com/v2/url?u=http-3A__amazon.com&d=DwIFAg&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=x3rBwxMTlO3UcnVchBJYlkqPD8BpO91HbuZYQ_ZepUs&m=Ab2mGfNvVyI4ehCNV5JKQWPeSfKRBgCvGNAQ4IV6faU&s=vKp3qkPX_q53UI9DdpZ25gPL7UmftbfN4K7Yj20kgH8&e=
with our affiliate
link:
https://urldefense.proofpoint.com/v2/url?u=https-3A__amazon.midrange.com&d=DwIFAg&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=x3rBwxMTlO3UcnVchBJYlkqPD8BpO91HbuZYQ_ZepUs&m=Ab2mGfNvVyI4ehCNV5JKQWPeSfKRBgCvGNAQ4IV6faU&s=Hola-a7jyK4FcIBvirBBBQXO5JU8XFptVjo2mi6VvXI&e=
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx To subscribe,
unsubscribe, or change list options,
visit:
https://urldefense.proofpoint.com/v2/url?u=https-3A__lists.midrange.com_mailman_listinfo_midrange-2Dl&d=DwIFAg&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=x3rBwxMTlO3UcnVchBJYlkqPD8BpO91HbuZYQ_ZepUs&m=Ab2mGfNvVyI4ehCNV5JKQWPeSfKRBgCvGNAQ4IV6faU&s=augqYrCJFn0diFdjH_NgIEs7eDxLkAznf3i27bPFj-o&e=
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives at
https://urldefense.proofpoint.com/v2/url?u=https-3A__archive.midrange.com_midrange-2Dl&d=DwIFAg&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=x3rBwxMTlO3UcnVchBJYlkqPD8BpO91HbuZYQ_ZepUs&m=Ab2mGfNvVyI4ehCNV5JKQWPeSfKRBgCvGNAQ4IV6faU&s=mfDCf8WXAR5eKTnJ9gLW7tkJMv3WOZ-izpx_ZlaY3Vg&e=
.
Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related
questions.
Help support
https://urldefense.proofpoint.com/v2/url?u=http-3A__midrange.com&d=DwIFAg&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=x3rBwxMTlO3UcnVchBJYlkqPD8BpO91HbuZYQ_ZepUs&m=Ab2mGfNvVyI4ehCNV5JKQWPeSfKRBgCvGNAQ4IV6faU&s=hTU-0LdmeG_7MrqM6shHg-VymfqINeqAUZeLKBO9T3Y&e=
by shopping at
https://urldefense.proofpoint.com/v2/url?u=http-3A__amazon.com&d=DwIFAg&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=x3rBwxMTlO3UcnVchBJYlkqPD8BpO91HbuZYQ_ZepUs&m=Ab2mGfNvVyI4ehCNV5JKQWPeSfKRBgCvGNAQ4IV6faU&s=vKp3qkPX_q53UI9DdpZ25gPL7UmftbfN4K7Yj20kgH8&e=
with our affiliate link:
https://urldefense.proofpoint.com/v2/url?u=https-3A__amazon.midrange.com&d=DwIFAg&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=x3rBwxMTlO3UcnVchBJYlkqPD8BpO91HbuZYQ_ZepUs&m=Ab2mGfNvVyI4ehCNV5JKQWPeSfKRBgCvGNAQ4IV6faU&s=Hola-a7jyK4FcIBvirBBBQXO5JU8XFptVjo2mi6VvXI&e=
midrange.com
