Troubleshooting network authentication service

This troubleshooting information includes common problems for network authentication service, Enterprise Identity Mapping (EIM), and IBM-supplied applications that support Kerberos authentication.

1. Complete all prerequisites.
2. Ensure that the user has a user profile on the IBM® i platform and a principal on the Kerberos server. On the IBM i platform, verify that the user exists by opening the Users and Groups in IBM Navigator for i or by typing the WRKUSRPRF (Work with User Profile) command on a command line. On systems running a Windows operating system, verify that the user exists by accessing the Active Directory Users and Computers folder.
3. Check to see if the IBM i platform is contacting the Kerberos server by using the kinit command from Qshell Interpreter. If the kinit command fails, check to see if the IBM i service principal has been registered on the Kerberos server. If it has not, you can add the IBM i principal to the Kerberos server.