RE: SSO Setup Issue - Error

Don,

Using Nav for I, in your EIM domain, did you create an identifier, source association, and target association.
There is also an option to test this.

Paul

From: Don Brown <DBrown@xxxxxxxxxx>
Sent: Tuesday, July 20, 2021 7:14 PM
To: Steinmetz, Paul <PSteinmetz@xxxxxxxxxx>
Cc: 'Midrange Systems Technical Discussion' <midrange-l@xxxxxxxxxxxxxxxxxx>; MIDRANGE-L <midrange-l-bounces@xxxxxxxxxxxxxxxxxx>
Subject: RE: SSO Setup Issue - Error

Thanks Paul,

Yes the kinit does succeed

As far as folowing the set up document goes everything that has a way to verify has passed / succeeded.

It is the final step where I set the iACS connection to kerberos and try and connect when I get the error.

Any suggestions on how to identify the error ?

Thanks

Don






From: "Steinmetz, Paul" <PSteinmetz@xxxxxxxxxx<mailto:PSteinmetz@xxxxxxxxxx>>
To: "'Midrange Systems Technical Discussion'" <midrange-l@xxxxxxxxxxxxxxxxxx<mailto:midrange-l@xxxxxxxxxxxxxxxxxx>>
Cc: "Don Brown" <DBrown@xxxxxxxxxx<mailto:DBrown@xxxxxxxxxx>>, "MIDRANGE-L" <midrange-l-bounces@xxxxxxxxxxxxxxxxxx<mailto:midrange-l-bounces@xxxxxxxxxxxxxxxxxx>>
Date: 20/07/2021 10:47 PM
Subject: RE: SSO Setup Issue - Error
________________________________



Using qsh, you can see all your principals in your keytab file.

kinit -k

Then you can verify your config by running the below for one of your principals.
The domain is case sensitive.
Should return only a $ if working properly.

kinit -k krbsvr400/FQCN@domain
$

Paul

-----Original Message-----
From: MIDRANGE-L <midrange-l-bounces@xxxxxxxxxxxxxxxxxx<mailto:midrange-l-bounces@xxxxxxxxxxxxxxxxxx>> On Behalf Of Don Brown via MIDRANGE-L
Sent: Tuesday, July 20, 2021 2:21 AM
To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxxxxxxxx<mailto:midrange-l@xxxxxxxxxxxxxxxxxx>>
Cc: Don Brown <DBrown@xxxxxxxxxx<mailto:DBrown@xxxxxxxxxx>>; MIDRANGE-L <midrange-l-bounces@xxxxxxxxxxxxxxxxxx<mailto:midrange-l-bounces@xxxxxxxxxxxxxxxxxx>>
Subject: Re: SSO Setup Issue - Error

________________________________
CAUTION: This email originated from outside of the PENCOR network. Do not click on any links or open attachments unless the sender is known, and the content is verified as safe.
________________________________

I did find in the service logs the following informaiton


# WARNING# 2021/07/20 14:02:04.668 AEST# Thread: 67# com.ibm.iaccess.base.AcsSystemConfig.getAuthKerberos
(AcsSystemConfig.java:1983) [/4.dat]
SNAP **** Exception!
SNAP class com.ibm.as400.access.AS400SecurityException: Kerberos
service ticket could not be retrieved.

SNAP Caused by: class org.ietf.jgss.GSSException: Failure unspecified
at GSS-API level (Mechanism level: 80090303=InitializeSecurityContext()
len=16384 ctx=00000000 SEC_E_TARGET_UNKNOWN) SNAP

Which indicates it could not obtain a service ticket but I can find anything meaningful as to why .

Don



From: "Don Brown via MIDRANGE-L" <midrange-l@xxxxxxxxxxxxxxxxxx<mailto:midrange-l@xxxxxxxxxxxxxxxxxx>>
To: midrange-l@xxxxxxxxxxxxxxxxxx<mailto:midrange-l@xxxxxxxxxxxxxxxxxx>
Cc: "Don Brown" <DBrown@xxxxxxxxxx<mailto:DBrown@xxxxxxxxxx>>
Date: 20/07/2021 04:02 PM
Subject: SSO Setup Issue - Error
Sent by: "MIDRANGE-L" <midrange-l-bounces@xxxxxxxxxxxxxxxxxx<mailto:midrange-l-bounces@xxxxxxxxxxxxxxxxxx>>



I am trying to set up SSO on a V7R3 IBMi

The box does not have support - it is only used for testing and is being decommissioned

This is just a proof of concept / test for SSO

I have followed the document
https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ibm.com_support_pages_how-2Dconfigure-2Deim-2Dand-2Dnas-2Dusing-2Dibm-2Dnavigator-2Di&d=DwIFAg&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=x3rBwxMTlO3UcnVchBJYlkqPD8BpO91HbuZYQ_ZepUs&m=Ab2mGfNvVyI4ehCNV5JKQWPeSfKRBgCvGNAQ4IV6faU&s=2dhvygJJXJbcJauI0JqOMWt_8w_V5WKIPhHT4_kXwdU&e=



All the verification has succeeded but when I try to log on using kerberos

authentication I get the error;

MSGKRB001 - Kerberos error for system <ip-address> (Failure unspecified at GSS-API level (Mechanism
level:80090303=InitiateSecurityContext() len=16384 ctx=00000000
SEC_E_TARGET_UNKNOWN))

Can anyone point me in the right direction to understand / resolve this issue.

Thank you in advance.

Don


--
This email has been scanned for computer viruses. Although MSD has taken reasonable precautions to ensure no viruses are present in this email, MSD cannot accept responsibility for any loss or damage arising from the use of this email or attachments..
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx<mailto:MIDRANGE-L@xxxxxxxxxxxxxxxxxx> To subscribe, unsubscribe, or change list options,
visit: https://urldefense.proofpoint.com/v2/url?u=https-3A__lists.midrange.com_mailman_listinfo_midrange-2Dl&d=DwIFAg&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=x3rBwxMTlO3UcnVchBJYlkqPD8BpO91HbuZYQ_ZepUs&m=Ab2mGfNvVyI4ehCNV5JKQWPeSfKRBgCvGNAQ4IV6faU&s=augqYrCJFn0diFdjH_NgIEs7eDxLkAznf3i27bPFj-o&e=
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx<mailto:MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx>
Before posting, please take a moment to review the archives at https://urldefense.proofpoint.com/v2/url?u=https-3A__archive.midrange.com_midrange-2Dl&d=DwIFAg&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=x3rBwxMTlO3UcnVchBJYlkqPD8BpO91HbuZYQ_ZepUs&m=Ab2mGfNvVyI4ehCNV5JKQWPeSfKRBgCvGNAQ4IV6faU&s=mfDCf8WXAR5eKTnJ9gLW7tkJMv3WOZ-izpx_ZlaY3Vg&e=.

Please contact support@xxxxxxxxxxxxxxxxxxxx<mailto:support@xxxxxxxxxxxxxxxxxxxx> for any subscription related questions.

Help support https://urldefense.proofpoint.com/v2/url?u=http-3A__midrange.com&d=DwIFAg&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=x3rBwxMTlO3UcnVchBJYlkqPD8BpO91HbuZYQ_ZepUs&m=Ab2mGfNvVyI4ehCNV5JKQWPeSfKRBgCvGNAQ4IV6faU&s=hTU-0LdmeG_7MrqM6shHg-VymfqINeqAUZeLKBO9T3Y&e= by shopping at https://urldefense.proofpoint.com/v2/url?u=http-3A__amazon.com&d=DwIFAg&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=x3rBwxMTlO3UcnVchBJYlkqPD8BpO91HbuZYQ_ZepUs&m=Ab2mGfNvVyI4ehCNV5JKQWPeSfKRBgCvGNAQ4IV6faU&s=vKp3qkPX_q53UI9DdpZ25gPL7UmftbfN4K7Yj20kgH8&e= with our affiliate
link: https://urldefense.proofpoint.com/v2/url?u=https-3A__amazon.midrange.com&d=DwIFAg&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=x3rBwxMTlO3UcnVchBJYlkqPD8BpO91HbuZYQ_ZepUs&m=Ab2mGfNvVyI4ehCNV5JKQWPeSfKRBgCvGNAQ4IV6faU&s=Hola-a7jyK4FcIBvirBBBQXO5JU8XFptVjo2mi6VvXI&e=




--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx<mailto:MIDRANGE-L@xxxxxxxxxxxxxxxxxx> To subscribe, unsubscribe, or change list options,
visit: https://urldefense.proofpoint.com/v2/url?u=https-3A__lists.midrange.com_mailman_listinfo_midrange-2Dl&d=DwIFAg&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=x3rBwxMTlO3UcnVchBJYlkqPD8BpO91HbuZYQ_ZepUs&m=Ab2mGfNvVyI4ehCNV5JKQWPeSfKRBgCvGNAQ4IV6faU&s=augqYrCJFn0diFdjH_NgIEs7eDxLkAznf3i27bPFj-o&e=
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx<mailto:MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx>
Before posting, please take a moment to review the archives at https://urldefense.proofpoint.com/v2/url?u=https-3A__archive.midrange.com_midrange-2Dl&d=DwIFAg&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=x3rBwxMTlO3UcnVchBJYlkqPD8BpO91HbuZYQ_ZepUs&m=Ab2mGfNvVyI4ehCNV5JKQWPeSfKRBgCvGNAQ4IV6faU&s=mfDCf8WXAR5eKTnJ9gLW7tkJMv3WOZ-izpx_ZlaY3Vg&e=.

Please contact support@xxxxxxxxxxxxxxxxxxxx<mailto:support@xxxxxxxxxxxxxxxxxxxx> for any subscription related questions.

Help support https://urldefense.proofpoint.com/v2/url?u=http-3A__midrange.com&d=DwIFAg&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=x3rBwxMTlO3UcnVchBJYlkqPD8BpO91HbuZYQ_ZepUs&m=Ab2mGfNvVyI4ehCNV5JKQWPeSfKRBgCvGNAQ4IV6faU&s=hTU-0LdmeG_7MrqM6shHg-VymfqINeqAUZeLKBO9T3Y&e= by shopping at https://urldefense.proofpoint.com/v2/url?u=http-3A__amazon.com&d=DwIFAg&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=x3rBwxMTlO3UcnVchBJYlkqPD8BpO91HbuZYQ_ZepUs&m=Ab2mGfNvVyI4ehCNV5JKQWPeSfKRBgCvGNAQ4IV6faU&s=vKp3qkPX_q53UI9DdpZ25gPL7UmftbfN4K7Yj20kgH8&e= with our affiliate link: https://urldefense.proofpoint.com/v2/url?u=https-3A__amazon.midrange.com&d=DwIFAg&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=x3rBwxMTlO3UcnVchBJYlkqPD8BpO91HbuZYQ_ZepUs&m=Ab2mGfNvVyI4ehCNV5JKQWPeSfKRBgCvGNAQ4IV6faU&s=Hola-a7jyK4FcIBvirBBBQXO5JU8XFptVjo2mi6VvXI&e=