The message: "javax.security.auth.login.LoginException: Message stream modified (41)" appears when configuring MicroStrategy Library with Kerberos Integrated Authentication

Description

After applying all required steps to configure Strategy Library with Kerberos Integrated Authentication according to How to configure Kerberos Authentication for MicroStrategy Library 10.x using Tomcat on Windows and Linux , the login page does not provide the option to authenticate using Kerberos Integrated authentication. 
Note that several reasons can cause Kerberos Integrated Authentication to note be available on the Strategy Library login page. Most common are configuration issues. If the principal cannot be initialized during Strategy Library startup, the option to login using Kerberos Integrated authentication is not shown.
For troubleshooting purposes, the auth.kerberos.debug=true parameter may be set in configOverride.properties (StrategyLibrary/WEB-INF/classes/config) to provide additional information in Strategy Library log (Strategy Library logs are configured in logback.xml under StrategyLibrary/WEB-INF/classes). 
In this particular scenario the following error message may be seen in Strategy Library logs:
 

{"@timestamp":"2018-09-11T17:46:22.789+01:00","@version":1,"message":"Kerberos configuration error",
"logger_name":"com.Strategy.auth.kerberos.SunJaasKerberosTicketValidator",
"thread_name":"localhost-startStop-1","level":"ERROR",
"level_value":40000,
"stack_trace":"javax.security.auth.login.LoginException: Message stream modified (41)
\r\n\tat com.sun.security.auth.module.Krb5LoginModule.attemptAuthentication(Krb5LoginModule.java:804)
\r\n\tat com.sun.security.auth.module.Krb5LoginModule.login(Krb5LoginModule.java:617)
\r\n\tat sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
\r\n\tat sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
\r\n\tat sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
\r\n\tat java.lang.reflect.Method.invoke(Method.java:498)
\r\n\tat javax.security.auth.login.LoginContext.invoke(LoginContext.java:755)
\r\n\tat javax.security.auth.login.LoginContext.access$000(LoginContext.java:195)
\r\n\tat javax.security.auth.login.LoginContext$4.run(LoginContext.java:682)
\r\n\tat javax.security.auth.login.LoginContext$4.run(LoginContext.java:680)
\r\n\tat java.security.AccessController.doPrivileged(Native Method)
\r\n\tat javax.security.auth.login.LoginContext.invokePriv(LoginContext.java:680)
\r\n\tat javax.security.auth.login.LoginContext.login(LoginContext.java:587)
\r\n\tat com.Strategy.auth.kerberos.SunJaasKerberosTicketValidator.afterPropertiesSet(SunJaasKerberosTicketValidator.java:82)
\r\n\tat com.Strategy.auth.kerberos.JaasKerberosTicketValidator.afterPropertiesSet(JaasKerberosTicketValidator.java:46)
\r\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.invokeInitMethods(AbstractAutowireCapableBeanFactory.java:1687)
\r\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1624)
\r\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:555)
\r\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:483)

Why is this happening?

This error may occur when the Active Directory service account used as the principal for Strategy Library Kerberos has the account option "Account is sensitive and cannot be delegated" enabled. View the option in the image below:

Solution 

1. Disable  "Account is sensitive and cannot be delegated".
   
2. Uncheck this account option if selected in the above window (Image 1).
   

• Active Directory service accounts for Strategy application servers must be able to delegate Kerberos tickets to the Intelligence Server.

Learning Resources

Interested in learning more about Library Administration?
Check out the Learning Center and our Education courses, such as 11.311 Administration for Enterprise Analytics.