Out of support This documentation supports the 8.1 version of BMC Atrium Single Sign-On, which is in "End of Version Support." However, the documentation is available for your convenience. You will not be able to leave comments.Click here to view the documentation for a supported version of Remedy Single Sign-On.

Invalid service principal name for Kerberos authentication

This error messages indicates a possible failure due to a discrepancy between the service principal name in the keytab file and the actual service principal name in the TGS or Active Directory. This error can be caused by renaming the service principal in the TGS without updating the keytab file. Validate the name (case-sensitive) and re-generate the keytab file if the service principal name has changed.

amAuthWindowsDesktopSSO:06/28/2011 04:24:33:854 PM CDT: Thread[http-8443-1,5,main]
New Service Login ...
amAuthWindowsDesktopSSO:06/28/2011 04:24:33:870 PM CDT: Thread[http-8443-1,5,main]
ERROR: Service Login Error:
amAuthWindowsDesktopSSO:06/28/2011 04:24:33:870 PM CDT: Thread[http-8443-1,5,main]
Stack trace:
javax.security.auth.login.LoginException: Client not found in Kerberos database (6)
at com.sun.security.auth.module.Krb5LoginModule.attemptAuthentication(Krb5LoginModule.java:696)
at com.sun.security.auth.module.Krb5LoginModule.login(Krb5LoginModule.java:542)

Note

To check for duplicate SPNs, use any of the following commands:

  • setspn.exe -X
  • setspn.exe -Q <SPN>

 

Tip: For faster searching, add an asterisk to the end of your partial query. Example: cert*