KB46586: Error 400 is thrown when using Kerberos (Integrated authentication) in MicroStrategy Web 9.x or 10.x

SYMPTOM
An error 400 can be thrown when authenticating in Strategy Web 9.x or 10.x with Kerberos (Integrated authentication).
 
CAUSE
Internet Explorer (IE) reports status code 400. This may be due to a large Kerberos token sent from the browser and rejected by Tomcat's HTTP connector. By default, Tomcat has a hard coded limit of 4Kb for an HTTP header, and if the Kerberos token exceeds 4Kb then Tomcat returns status code 400 without passing the request to the Mid Tier. The standard BMC Tomcat
distribution has been known to have 8Kb set, which can still be inadequate. The reason it can happen on some instances of IE and not others is that the Kerberos token contains the user's Active Directory groups. If a user is a member of many groups, their Kerberos token can become very large, exceeding the limit in Tomcat.
 
ACTION

1. Open the Tomcat server.xml file, look for the HTTP connector:
2. <Connector port="8080" protocol="HTTP/1.1" and add a maxHttpHeaderSize attribute, which is given a value in bytes (24576 is 24Kb):
   <Connector port="8080" protocol="HTTP/1.1"  maxHttpHeaderSize=”24576”
3. This modification requires a restart of the web server.

KB46586