IBM Support

Unable to negotiate authorization - Single sign-on stops working in Workspace after upgrading Planning Analytics to 2.0.9.1

Troubleshooting


Problem

A working environment has been updated to Planning Analytics 2.0.9.1.
This environment includes a TM1 Server configured for SSO, using Integrated Windows Authentication (IWA).
The tm1s.cfg of the TM1 Server contains these parameters to achieve this:
SecurityPackageName=kerberos
IntegratedSecurityMode=3
Since this upgrade, it is not possible to connect to Planning Analytics Workspace.
 

Symptom

The users are receiving these errors in the internet browser:
"Unexpected authentication error"
"Unable to negotiate authorization"

In the WAproxy.log (in <PAW>/log/wa-proxy) there is an error HTTP 401 during the Negotiate, followed by an error HTTP 500:
"Unable to perform TM1 JWT auth.  This service is not configured to perform TM1 JWT auth (missing JWT key)"

Document Location

Worldwide

[{"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSCTEW","label":"IBM Planning Analytics Local"},"ARM Category":[{"code":"a8m50000000KzKMAA0","label":"Security-\u003ESSO"},{"code":"a8m0z000000blfjAAA","label":"Troubleshooting"}],"ARM Case Number":"","Platform":[{"code":"PF033","label":"Windows"}],"Version":"All Version(s)","Line of Business":{"code":"LOB76","label":"Data Platform"}},{"Product":{"code":"SSKVSF","label":"Planning Analytics on Cloud"},"Business Unit":{"code":"BU048","label":"IBM Software"},"Component":" ","Platform":[{"code":"","label":""}],"Version":"","Edition":"","Line of Business":{"code":"LOB76","label":"Data Platform"}}]

Log InLog in to view more of this document

This document has the abstract of a technical article that is available to authorized users once you have logged on. Please use Log in button above to access the full document. After log in, if you do not have the right authorization for this document, there will be instructions on what to do next.

Document Information

Modified date:
09 May 2025

UID

ibm16219292