Troubleshooting
Problem
Error occurs when starting FileNet Enterprise Manager (FEM) and connecting to the P8 domain.
Symptom
Content Engine with SSO / Kerberos is configured according to the P8 documentation. The Service Principal Names for the server were registered using both short and fully qualified names using he setspn -A command as documented in the P8 5.1 Information Center documentation. No errors were encountered during configuration.
When trying to connect to FileNet Enterprise Manager (FEM) for the first time, the following error is returned when trying to login and connect to the P8 domain:
[7/3/13 14:30:22:220 MDT] 0000003d SystemOut O [KrbServiceLoginModule] login failure: Failed Kerberos service ticket login: could not establish context
[7/3/13 14:30:22:235 MDT] 0000003d LdapRegistryI E No user KerberosUser found
[7/3/13 14:30:22:251 MDT] 0000003d LdapRegistryI E SECJ0336E: Authentication failed for user KerberosUser because of the following exception com.ibm.websphere.security.PasswordCheckFailedException: No user KerberosUser found
[7/3/13 14:30:22:251 MDT] 0000003d LTPAServerObj E SECJ0369E: Authentication failed when using LTPA. The exception is No user KerberosUser found.
[7/3/13 14:30:22:267 MDT] 0000003d SystemOut O [KrbServiceLoginModule] aborting
[7/3/13 14:30:22:267 MDT] 0000003d SystemOut O [WSIAuthenticatorImpl] Web services Kerberos login failed: Failed Kerberos service ticket login: could not establish context.: Failed Kerberos service ticket login: could not establish context
Cause
The issue is caused by an invalid value in the SPN. The results from setspn -l p8admin:
FNCEWS/server-name@filenet.com
FNCEWS/server-name
However, there is an error in the fully qualified path. In reviewing the syntax for the fully qualified path, it should be as follows:
FNCEWS/server-name.filenet.com
With a "." in place of the "@". The P8 documentation incorrectly state to use the "@" in the fully qualified path for the setspn command.
Environment
CE 5.1
Windows 2008 R2
SSO / Kerberos
Resolving The Problem
To correct the SPN, delete the incorrect SPN and recreate it with the following commands:
setspn -D FNCEWS/server-name@filenet.com p8admin
setspn -A FNCEWS/server-name.filenet.com p8admin
The keytab will also need to be recreated and WebSphere restarted.
Was this topic helpful?
Document Information
Modified date:
17 June 2018
UID
swg21644049