RE: SSO Setup Issue - Error

Don,

In INav, one tab before you open your identifiers, there is a test action.

Paul

From: Don Brown <DBrown@xxxxxxxxxx>
Sent: Tuesday, July 20, 2021 9:52 PM
To: Steinmetz, Paul <PSteinmetz@xxxxxxxxxx>
Cc: 'Midrange Systems Technical Discussion' <midrange-l@xxxxxxxxxxxxxxxxxx>; MIDRANGE-L <midrange-l-bounces@xxxxxxxxxxxxxxxxxx>
Subject: RE: SSO Setup Issue - Error

________________________________
CAUTION: This email originated from outside of the PENCOR network. Do not click on any links or open attachments unless the sender is known, and the content is verified as safe.
________________________________
Yes Paul I did.

After running the NAS set up I ran the kinit test with the domanin name

kinit -k <domain_name>

After running this I receive back the $ prompt which the documentation indicates it has worked successfully

I have set up the IBM Tivoli Directory Server (LDAP) - there is no option to verify but this is just defining the password

and yes the server is started.

I created the EIM domain on the local server and verified the connection - Successfully

I then created an EIM Identifier with source and target associations which creates successfully.

But I can't see anywhere to test the Source and Target entries - where are you seeing this ???

I then am connecting to a VPN and logging on the a server that I have installed Java and iACS.

I am logging into the domain that was configured in NAS

I create a system connection specifying kerberos authentication.

I then try and start a 5250 session and receive the error

MSGKRB001 - Kerberos error for system <ip-address> (Failure unspecified at GSS-API level (Mechanism
level:80090303=InitiateSecurityContext() len=16384 ctx=00000000
SEC_E_TARGET_UNKNOWN))


I have reviewed all this set up and re verified connections and all seems fine.

Any suggestions ?

Thanks

Don






From: "Steinmetz, Paul" <PSteinmetz@xxxxxxxxxx<mailto:PSteinmetz@xxxxxxxxxx>>
To: "'Don Brown'" <DBrown@xxxxxxxxxx<mailto:DBrown@xxxxxxxxxx>>
Cc: "'Midrange Systems Technical Discussion'" <midrange-l@xxxxxxxxxxxxxxxxxx<mailto:midrange-l@xxxxxxxxxxxxxxxxxx>>, "MIDRANGE-L" <midrange-l-bounces@xxxxxxxxxxxxxxxxxx<mailto:midrange-l-bounces@xxxxxxxxxxxxxxxxxx>>
Date: 21/07/2021 10:20 AM
Subject: RE: SSO Setup Issue - Error
________________________________


Don,



Using Nav for I, in your EIM domain, did you create an identifier, source association, and target association.

There is also an option to test this.



Paul



From: Don Brown <DBrown@xxxxxxxxxx<mailto:DBrown@xxxxxxxxxx>>
Sent: Tuesday, July 20, 2021 7:14 PM
To: Steinmetz, Paul <PSteinmetz@xxxxxxxxxx<mailto:PSteinmetz@xxxxxxxxxx>>
Cc: 'Midrange Systems Technical Discussion' <midrange-l@xxxxxxxxxxxxxxxxxx<mailto:midrange-l@xxxxxxxxxxxxxxxxxx>>; MIDRANGE-L <midrange-l-bounces@xxxxxxxxxxxxxxxxxx<mailto:midrange-l-bounces@xxxxxxxxxxxxxxxxxx>>
Subject: RE: SSO Setup Issue - Error



Thanks Paul,

Yes the kinit does succeed

As far as folowing the set up document goes everything that has a way to verify has passed / succeeded.

It is the final step where I set the iACS connection to kerberos and try and connect when I get the error.

Any suggestions on how to identify the error ?

Thanks

Don






From: "Steinmetz, Paul" <PSteinmetz@xxxxxxxxxx<mailto:PSteinmetz@xxxxxxxxxx>>
To: "'Midrange Systems Technical Discussion'" <midrange-l@xxxxxxxxxxxxxxxxxx<mailto:midrange-l@xxxxxxxxxxxxxxxxxx>>
Cc: "Don Brown" <DBrown@xxxxxxxxxx<mailto:DBrown@xxxxxxxxxx>>, "MIDRANGE-L" <midrange-l-bounces@xxxxxxxxxxxxxxxxxx<mailto:midrange-l-bounces@xxxxxxxxxxxxxxxxxx>>
Date: 20/07/2021 10:47 PM
Subject: RE: SSO Setup Issue - Error

________________________________



Using qsh, you can see all your principals in your keytab file.

kinit -k

Then you can verify your config by running the below for one of your principals.
The domain is case sensitive.
Should return only a $ if working properly.

kinit -k krbsvr400/FQCN@domain
$

Paul

-----Original Message-----
From: MIDRANGE-L <midrange-l-bounces@xxxxxxxxxxxxxxxxxx<mailto:midrange-l-bounces@xxxxxxxxxxxxxxxxxx>> On Behalf Of Don Brown via MIDRANGE-L
Sent: Tuesday, July 20, 2021 2:21 AM
To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxxxxxxxx<mailto:midrange-l@xxxxxxxxxxxxxxxxxx>>
Cc: Don Brown <DBrown@xxxxxxxxxx<mailto:DBrown@xxxxxxxxxx>>; MIDRANGE-L <midrange-l-bounces@xxxxxxxxxxxxxxxxxx<mailto:midrange-l-bounces@xxxxxxxxxxxxxxxxxx>>
Subject: Re: SSO Setup Issue - Error

________________________________
CAUTION: This email originated from outside of the PENCOR network. Do not click on any links or open attachments unless the sender is known, and the content is verified as safe.
________________________________

I did find in the service logs the following informaiton


# WARNING# 2021/07/20 14:02:04.668 AEST# Thread: 67# com.ibm.iaccess.base.AcsSystemConfig.getAuthKerberos
(AcsSystemConfig.java:1983) [/4.dat]
SNAP **** Exception!
SNAP class com.ibm.as400.access.AS400SecurityException: Kerberos
service ticket could not be retrieved.

SNAP Caused by: class org.ietf.jgss.GSSException: Failure unspecified
at GSS-API level (Mechanism level: 80090303=InitializeSecurityContext()
len=16384 ctx=00000000 SEC_E_TARGET_UNKNOWN) SNAP

Which indicates it could not obtain a service ticket but I can find anything meaningful as to why .

Don



From: "Don Brown via MIDRANGE-L" <midrange-l@xxxxxxxxxxxxxxxxxx<mailto:midrange-l@xxxxxxxxxxxxxxxxxx>>
To: midrange-l@xxxxxxxxxxxxxxxxxx<mailto:midrange-l@xxxxxxxxxxxxxxxxxx>
Cc: "Don Brown" <DBrown@xxxxxxxxxx<mailto:DBrown@xxxxxxxxxx>>
Date: 20/07/2021 04:02 PM
Subject: SSO Setup Issue - Error
Sent by: "MIDRANGE-L" <midrange-l-bounces@xxxxxxxxxxxxxxxxxx<mailto:midrange-l-bounces@xxxxxxxxxxxxxxxxxx>>



I am trying to set up SSO on a V7R3 IBMi

The box does not have support - it is only used for testing and is being decommissioned

This is just a proof of concept / test for SSO

I have followed the document
https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ibm.com_support_pages_how-2Dconfigure-2Deim-2Dand-2Dnas-2Dusing-2Dibm-2Dnavigator-2Di&d=DwIFAg&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=x3rBwxMTlO3UcnVchBJYlkqPD8BpO91HbuZYQ_ZepUs&m=Ab2mGfNvVyI4ehCNV5JKQWPeSfKRBgCvGNAQ4IV6faU&s=2dhvygJJXJbcJauI0JqOMWt_8w_V5WKIPhHT4_kXwdU&e=<https://smex-ctp.trendmicro.com:443/wis/clicktime/v1/query?url=https%3a%2f%2furldefense.proofpoint.com%2fv2%2furl%3fu%3dhttps%2d3A%5f%5fwww.ibm.com%5fsupport%5fpages%5fhow%2d2Dconfigure%2d2Deim%2d2Dand%2d2Dnas%2d2Dusing%2d2Dibm%2d2Dnavigator%2d2Di%26d%3dDwIFAg%26c%3deuGZstcaTDllvimEN8b7jXrwqOf%2dv5A%5fCdpgnVfiiMM%26r%3dx3rBwxMTlO3UcnVchBJYlkqPD8BpO91HbuZYQ%5fZepUs%26m%3dAb2mGfNvVyI4ehCNV5JKQWPeSfKRBgCvGNAQ4IV6faU%26s%3d2dhvygJJXJbcJauI0JqOMWt%5f8w%5fV5WKIPhHT4%5fkXwdU%26e%3d&umid=2df10f24-cd6e-42dd-ad5b-efbf80ee8e33&auth=535da7a44b4448e3efacc7e853d4b7239c38757d-ee423599341637b4a4e57ae6c14d15a539a3cedd>



All the verification has succeeded but when I try to log on using kerberos

authentication I get the error;

MSGKRB001 - Kerberos error for system <ip-address> (Failure unspecified at GSS-API level (Mechanism
level:80090303=InitiateSecurityContext() len=16384 ctx=00000000
SEC_E_TARGET_UNKNOWN))

Can anyone point me in the right direction to understand / resolve this issue.

Thank you in advance.

Don


--
This email has been scanned for computer viruses. Although MSD has taken reasonable precautions to ensure no viruses are present in this email, MSD cannot accept responsibility for any loss or damage arising from the use of this email or attachments..
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx<mailto:MIDRANGE-L@xxxxxxxxxxxxxxxxxx> To subscribe, unsubscribe, or change list options,
visit: https://urldefense.proofpoint.com/v2/url?u=https-3A__lists.midrange.com_mailman_listinfo_midrange-2Dl&d=DwIFAg&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=x3rBwxMTlO3UcnVchBJYlkqPD8BpO91HbuZYQ_ZepUs&m=Ab2mGfNvVyI4ehCNV5JKQWPeSfKRBgCvGNAQ4IV6faU&s=augqYrCJFn0diFdjH_NgIEs7eDxLkAznf3i27bPFj-o&e=<https://smex-ctp.trendmicro.com:443/wis/clicktime/v1/query?url=https%3a%2f%2furldefense.proofpoint.com%2fv2%2furl%3fu%3dhttps%2d3A%5f%5flists.midrange.com%5fmailman%5flistinfo%5fmidrange%2d2Dl%26d%3dDwIFAg%26c%3deuGZstcaTDllvimEN8b7jXrwqOf%2dv5A%5fCdpgnVfiiMM%26r%3dx3rBwxMTlO3UcnVchBJYlkqPD8BpO91HbuZYQ%5fZepUs%26m%3dAb2mGfNvVyI4ehCNV5JKQWPeSfKRBgCvGNAQ4IV6faU%26s%3daugqYrCJFn0diFdjH%5fNgIEs7eDxLkAznf3i27bPFj%2do%26e%3d&umid=2df10f24-cd6e-42dd-ad5b-efbf80ee8e33&auth=535da7a44b4448e3efacc7e853d4b7239c38757d-2d03689a1f1cc64ea9cc75ac1cf8bd5ae52b2236>
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx<mailto:MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx>
Before posting, please take a moment to review the archives at https://urldefense.proofpoint.com/v2/url?u=https-3A__archive.midrange.com_midrange-2Dl&d=DwIFAg&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=x3rBwxMTlO3UcnVchBJYlkqPD8BpO91HbuZYQ_ZepUs&m=Ab2mGfNvVyI4ehCNV5JKQWPeSfKRBgCvGNAQ4IV6faU&s=mfDCf8WXAR5eKTnJ9gLW7tkJMv3WOZ-izpx_ZlaY3Vg&e=<https://smex-ctp.trendmicro.com:443/wis/clicktime/v1/query?url=https%3a%2f%2furldefense.proofpoint.com%2fv2%2furl%3fu%3dhttps%2d3A%5f%5farchive.midrange.com%5fmidrange%2d2Dl%26d%3dDwIFAg%26c%3deuGZstcaTDllvimEN8b7jXrwqOf%2dv5A%5fCdpgnVfiiMM%26r%3dx3rBwxMTlO3UcnVchBJYlkqPD8BpO91HbuZYQ%5fZepUs%26m%3dAb2mGfNvVyI4ehCNV5JKQWPeSfKRBgCvGNAQ4IV6faU%26s%3dmfDCf8WXAR5eKTnJ9gLW7tkJMv3WOZ%2dizpx%5fZlaY3Vg%26e%3d&umid=2df10f24-cd6e-42dd-ad5b-efbf80ee8e33&auth=535da7a44b4448e3efacc7e853d4b7239c38757d-99f447abfb2f07e1db73ac33160af0ef5c2411f4>.

Please contact support@xxxxxxxxxxxxxxxxxxxx<mailto:support@xxxxxxxxxxxxxxxxxxxx> for any subscription related questions.

Help support https://urldefense.proofpoint.com/v2/url?u=http-3A__midrange.com&d=DwIFAg&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=x3rBwxMTlO3UcnVchBJYlkqPD8BpO91HbuZYQ_ZepUs&m=Ab2mGfNvVyI4ehCNV5JKQWPeSfKRBgCvGNAQ4IV6faU&s=hTU-0LdmeG_7MrqM6shHg-VymfqINeqAUZeLKBO9T3Y&e=<https://smex-ctp.trendmicro.com:443/wis/clicktime/v1/query?url=https%3a%2f%2furldefense.proofpoint.com%2fv2%2furl%3fu%3dhttp%2d3A%5f%5fmidrange.com%26d%3dDwIFAg%26c%3deuGZstcaTDllvimEN8b7jXrwqOf%2dv5A%5fCdpgnVfiiMM%26r%3dx3rBwxMTlO3UcnVchBJYlkqPD8BpO91HbuZYQ%5fZepUs%26m%3dAb2mGfNvVyI4ehCNV5JKQWPeSfKRBgCvGNAQ4IV6faU%26s%3dhTU%2d0LdmeG%5f7MrqM6shHg%2dVymfqINeqAUZeLKBO9T3Y%26e%3d&umid=2df10f24-cd6e-42dd-ad5b-efbf80ee8e33&auth=535da7a44b4448e3efacc7e853d4b7239c38757d-f9b76b70e6bbdcb8e883d5515d388abb9fe07526> by shopping at https://urldefense.proofpoint.com/v2/url?u=http-3A__amazon.com&d=DwIFAg&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=x3rBwxMTlO3UcnVchBJYlkqPD8BpO91HbuZYQ_ZepUs&m=Ab2mGfNvVyI4ehCNV5JKQWPeSfKRBgCvGNAQ4IV6faU&s=vKp3qkPX_q53UI9DdpZ25gPL7UmftbfN4K7Yj20kgH8&e=<https://smex-ctp.trendmicro.com:443/wis/clicktime/v1/query?url=https%3a%2f%2furldefense.proofpoint.com%2fv2%2furl%3fu%3dhttp%2d3A%5f%5famazon.com%26d%3dDwIFAg%26c%3deuGZstcaTDllvimEN8b7jXrwqOf%2dv5A%5fCdpgnVfiiMM%26r%3dx3rBwxMTlO3UcnVchBJYlkqPD8BpO91HbuZYQ%5fZepUs%26m%3dAb2mGfNvVyI4ehCNV5JKQWPeSfKRBgCvGNAQ4IV6faU%26s%3dvKp3qkPX%5fq53UI9DdpZ25gPL7UmftbfN4K7Yj20kgH8%26e%3d&umid=2df10f24-cd6e-42dd-ad5b-efbf80ee8e33&auth=535da7a44b4448e3efacc7e853d4b7239c38757d-69b8456f470ce21264f53c640b2f7d7c01bb37b5> with our affiliate
link: https://urldefense.proofpoint.com/v2/url?u=https-3A__amazon.midrange.com&d=DwIFAg&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=x3rBwxMTlO3UcnVchBJYlkqPD8BpO91HbuZYQ_ZepUs&m=Ab2mGfNvVyI4ehCNV5JKQWPeSfKRBgCvGNAQ4IV6faU&s=Hola-a7jyK4FcIBvirBBBQXO5JU8XFptVjo2mi6VvXI&e=




--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx<mailto:MIDRANGE-L@xxxxxxxxxxxxxxxxxx> To subscribe, unsubscribe, or change list options,
visit: https://urldefense.proofpoint.com/v2/url?u=https-3A__lists.midrange.com_mailman_listinfo_midrange-2Dl&d=DwIFAg&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=x3rBwxMTlO3UcnVchBJYlkqPD8BpO91HbuZYQ_ZepUs&m=Ab2mGfNvVyI4ehCNV5JKQWPeSfKRBgCvGNAQ4IV6faU&s=augqYrCJFn0diFdjH_NgIEs7eDxLkAznf3i27bPFj-o&e=<https://smex-ctp.trendmicro.com:443/wis/clicktime/v1/query?url=https%3a%2f%2furldefense.proofpoint.com%2fv2%2furl%3fu%3dhttps%2d3A%5f%5flists.midrange.com%5fmailman%5flistinfo%5fmidrange%2d2Dl%26d%3dDwIFAg%26c%3deuGZstcaTDllvimEN8b7jXrwqOf%2dv5A%5fCdpgnVfiiMM%26r%3dx3rBwxMTlO3UcnVchBJYlkqPD8BpO91HbuZYQ%5fZepUs%26m%3dAb2mGfNvVyI4ehCNV5JKQWPeSfKRBgCvGNAQ4IV6faU%26s%3daugqYrCJFn0diFdjH%5fNgIEs7eDxLkAznf3i27bPFj%2do%26e%3d&umid=2df10f24-cd6e-42dd-ad5b-efbf80ee8e33&auth=535da7a44b4448e3efacc7e853d4b7239c38757d-2d03689a1f1cc64ea9cc75ac1cf8bd5ae52b2236>
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx<mailto:MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx>
Before posting, please take a moment to review the archives at https://urldefense.proofpoint.com/v2/url?u=https-3A__archive.midrange.com_midrange-2Dl&d=DwIFAg&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=x3rBwxMTlO3UcnVchBJYlkqPD8BpO91HbuZYQ_ZepUs&m=Ab2mGfNvVyI4ehCNV5JKQWPeSfKRBgCvGNAQ4IV6faU&s=mfDCf8WXAR5eKTnJ9gLW7tkJMv3WOZ-izpx_ZlaY3Vg&e=<https://smex-ctp.trendmicro.com:443/wis/clicktime/v1/query?url=https%3a%2f%2furldefense.proofpoint.com%2fv2%2furl%3fu%3dhttps%2d3A%5f%5farchive.midrange.com%5fmidrange%2d2Dl%26d%3dDwIFAg%26c%3deuGZstcaTDllvimEN8b7jXrwqOf%2dv5A%5fCdpgnVfiiMM%26r%3dx3rBwxMTlO3UcnVchBJYlkqPD8BpO91HbuZYQ%5fZepUs%26m%3dAb2mGfNvVyI4ehCNV5JKQWPeSfKRBgCvGNAQ4IV6faU%26s%3dmfDCf8WXAR5eKTnJ9gLW7tkJMv3WOZ%2dizpx%5fZlaY3Vg%26e%3d&umid=2df10f24-cd6e-42dd-ad5b-efbf80ee8e33&auth=535da7a44b4448e3efacc7e853d4b7239c38757d-99f447abfb2f07e1db73ac33160af0ef5c2411f4>.

Please contact support@xxxxxxxxxxxxxxxxxxxx<mailto:support@xxxxxxxxxxxxxxxxxxxx> for any subscription related questions.

Help support https://urldefense.proofpoint.com/v2/url?u=http-3A__midrange.com&d=DwIFAg&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=x3rBwxMTlO3UcnVchBJYlkqPD8BpO91HbuZYQ_ZepUs&m=Ab2mGfNvVyI4ehCNV5JKQWPeSfKRBgCvGNAQ4IV6faU&s=hTU-0LdmeG_7MrqM6shHg-VymfqINeqAUZeLKBO9T3Y&e=<https://smex-ctp.trendmicro.com:443/wis/clicktime/v1/query?url=https%3a%2f%2furldefense.proofpoint.com%2fv2%2furl%3fu%3dhttp%2d3A%5f%5fmidrange.com%26d%3dDwIFAg%26c%3deuGZstcaTDllvimEN8b7jXrwqOf%2dv5A%5fCdpgnVfiiMM%26r%3dx3rBwxMTlO3UcnVchBJYlkqPD8BpO91HbuZYQ%5fZepUs%26m%3dAb2mGfNvVyI4ehCNV5JKQWPeSfKRBgCvGNAQ4IV6faU%26s%3dhTU%2d0LdmeG%5f7MrqM6shHg%2dVymfqINeqAUZeLKBO9T3Y%26e%3d&umid=2df10f24-cd6e-42dd-ad5b-efbf80ee8e33&auth=535da7a44b4448e3efacc7e853d4b7239c38757d-f9b76b70e6bbdcb8e883d5515d388abb9fe07526> by shopping at https://urldefense.proofpoint.com/v2/url?u=http-3A__amazon.com&d=DwIFAg&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=x3rBwxMTlO3UcnVchBJYlkqPD8BpO91HbuZYQ_ZepUs&m=Ab2mGfNvVyI4ehCNV5JKQWPeSfKRBgCvGNAQ4IV6faU&s=vKp3qkPX_q53UI9DdpZ25gPL7UmftbfN4K7Yj20kgH8&e=<https://smex-ctp.trendmicro.com:443/wis/clicktime/v1/query?url=https%3a%2f%2furldefense.proofpoint.com%2fv2%2furl%3fu%3dhttp%2d3A%5f%5famazon.com%26d%3dDwIFAg%26c%3deuGZstcaTDllvimEN8b7jXrwqOf%2dv5A%5fCdpgnVfiiMM%26r%3dx3rBwxMTlO3UcnVchBJYlkqPD8BpO91HbuZYQ%5fZepUs%26m%3dAb2mGfNvVyI4ehCNV5JKQWPeSfKRBgCvGNAQ4IV6faU%26s%3dvKp3qkPX%5fq53UI9DdpZ25gPL7UmftbfN4K7Yj20kgH8%26e%3d&umid=2df10f24-cd6e-42dd-ad5b-efbf80ee8e33&auth=535da7a44b4448e3efacc7e853d4b7239c38757d-69b8456f470ce21264f53c640b2f7d7c01bb37b5> with our affiliate link: https://urldefense.proofpoint.com/v2/url?u=https-3A__amazon.midrange.com&d=DwIFAg&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=x3rBwxMTlO3UcnVchBJYlkqPD8BpO91HbuZYQ_ZepUs&m=Ab2mGfNvVyI4ehCNV5JKQWPeSfKRBgCvGNAQ4IV6faU&s=Hola-a7jyK4FcIBvirBBBQXO5JU8XFptVjo2mi6VvXI&e=