When users attempt to log into Strategy Web Universal via Kerberos Integrated Authentication, their user credentials are not delegated to Intelligence Server and the user session is created for 3rd party user instead.
Welcome 3rd Party Users.
One possible cause for this behavior is the number of entries in the keytab file. More specifically, IBM JDK 1.6 that cannot handle more than one entry in the keytab file when used for Strategy Web Kerberos Integrated Authentication. No delegation of the user credentials will happen with more than one principal entry in the keytab file.
As a result, the user credentials are not delegated to Intelligence Server so that a session with an actually mapped Strategy user can be created. Instead, the user credentials passed to Intelligence Server are those from the Active Directory user that is used to run the web server. Since that Active Directory user is not mapped to a Strategy user, Intelligence Server uses the default 3rd party group for a temporary user session. By default this user group does not have access to any projects which in return leads to this page.
Recreate keytab file with one single principal entry only.
1. Delete / rename existing krb5.keytab
2. Create keytab file using ktutil:
> ktutil > ktutil: addent -password -p HTTP/FQDN@REALM -k -e rc4-hmac > ktutil: wkt /path/to/krb5configfiles/krb5.keytab > ktutil: quit
> kdestroy
> kinit -k -t /path/to/keytab/krb5.keytab HTTP/FQDN
1. Instead of using IBM JDK 1.6, upgrade to IBM JDK 1.7.
2. Instead of using IBM JDK 1.6, switch to Oracle JDK 1.6 or above.
Third Party Software Installation: WARNING:
The third-party product(s) discussed in this technical note is manufactured by vendors independent of Strategy. Strategy makes no warranty, express, implied or otherwise, regarding this product, including its performance or reliability.
KB47075
