KB486139: “Error in login - Login failure” when using Integrated authentication (Kerberos) in MicroStrategy Web ASP

Senior Cloud Support Engineer III • MicroStrategy

This article describes a behaviour within MicroStrategy Web ASP, whereby login to MicroStrategy Web using Kerberos or Integrated authentication fails with generic error “Error in Login – Login failure”.

Symptom

The MSTR Web logs will show following entry:

…<message>Login failure - unable to obtain Kerberos ticket for MSTRSVRSvc/xxxxx.Strategy.com:34952 - Operation unavailable (Mechanism level: Require Oracle JRE 1.8 for kerberos constrained delegation)</message><exception>GSSException: Operation unavailable (Mechanism level: Require Oracle JRE 1.8 for kerberos constrained delegation)
	at com.Strategy.webapi.KerberosSession.getTicket(Unknown…KrbException: S4U2self ticket must be FORWARDABLE
	at java.security.jgss/sun.security.krb5.internal.CredentialsUtil.acquireS4U2selfCreds(CredentialsUtil.java:105)
	at

Cause

This error occurs when everything seems to be set up correctly on IIS and constrained delegation is used for the service account on Active Directory side. However, constrained delegation is set to ‘Use Kerberos only’.

Action

Please make sure to select the option ‘Use any authentication protocol’ for constrained delegation:

Comment

0 comments

Details

Knowledge Article

Published:

July 27, 2023

Last Updated:

July 27, 2023