SYMPTOM:
When using Integrated Authentication, Kerberos, the end user gets the following error message:
No Valid Credentials Provided
authentication failed Cannot get KDC for realm XXXXXXX.XXX
If the krb5.conf contains syntax errors and is not properly read by the system, or the file was created in a windows environment and copied over to a UNIX environment or the KDC host name cannot be resolved this are all factors that could lead to the above error message.
The JVM reads the service principal name to be used from the JAAS.conf file. It extracts the domain information from the SPN provided and using the domain realm mapping information obtains the KDC host name / ip address. If any of those steps fails the JVM will not be able to obtain the location of the KDC
As explained above the KDC will obtain the domain name from the SPN passed. principal="HTTP/mars10.labs.mstr.net@LABS.MSTR.NET will pass the LABS.MSTR.NET domain. The domain declaration in the krb5.conf is case sensitive thus LABS.MSTR.NET is not the same as passing labs.mstr.net. The domain name for the principal name in the JAAS.conf should always be declared in upper case.
If both the above steps have been confirmed to be correct and the error is still being thrown, pass the following JAVA_OPTS for when starting the JVM
Those two JVM startup parameters will pass the realm and KDC location.
Third Party Software Installation WARNING
The third-party product(s) discussed in this technical note is manufactured by vendors independent of Strategy. Strategy makes no warranty, express, implied or otherwise, regarding this product, including its performance or reliability.
KB35501
