Troubleshooting
Problem
Using a native kerberos delegation junction you may have an error in WebSeal message log like: An error occurred when creating the Kerberos token: Client not found in Kerberos database
Symptom
Capturing a TCP-IP trace you can see that the KDC returns error :
KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN
Cause
In a delegation context involving multiple AD domain this can happen if the user that webseal impersonify is not found on the target KDC where the TGS-REQ arrives , this may be a consequence of a wrong rule defined in the kerberos-user-idenity entry for that junction and the user that has been used to authenticate to webseal.
Resolving The Problem
In order to solve the problem you need to first know which is a valid UPN for the target KDC then use a correct rule for the kerberos-user-idenity considering the following alternatives are available
kerberos-user-identity = username@domain
kerberos-user-identity = username
kerberos-user-identity = @domain
kerberos-user-identity = fqdn
but also any attribute in the user credential as for instance :
kerberos-user-identity = attr:AZN_CRED_PRINCIPAL_NAME
Was this topic helpful?
Document Information
Modified date:
16 June 2018
UID
swg21882700