Troubleshooting
Problem
A detail trace indicates error return code rc=0x80090. This can often be caused by duplicate entries with a given service principal name on the KDC (Key Distribution Center).
Resolving The Problem
Kerberos connections fail intermittently with iAccess error message CWBSY1012. A detail trace indicates error return code rc=0x80090xx. This can often be caused by duplicate entries with a given service principal name on the KDC (Key Distribution Center).
Additionally kinit -k fails with
EUVF06014E - Unable to obtain initial credentials.Status 0x96c73a06 - Client principal is not found in security registry.
***Refer to Rochester Support Center document, Troubleshooting Single Signon for information on taking a detail trace.***
Use one of the following commands on the Kerberos server (usually a Microsoft Active Directory server) on a command prompt:
Important Note: Whatever directory you are in when you run the command is where the OUTPUT.TXT file will be generated.
ldifde -m -f OUTPUT.TXT
This will produce a file called OUTPUT.TXT with all of the Active Directory contents.
ldifde -f check_SPN.txt -t 3268 -d "" -l servicePrincipalName -r "(servicePrincipalName=krbsvr400/*)" -p subtree
This will produce a file called check_SPN.txt with just the krbsvr400 entries in Active Directory
You can browse the entries returned and search for duplicate service principal names (generally labled "User Logon Name" in Active Directory entries).
Additionally kinit -k fails with
EUVF06014E - Unable to obtain initial credentials.Status 0x96c73a06 - Client principal is not found in security registry.
***Refer to Rochester Support Center document, Troubleshooting Single Signon for information on taking a detail trace.***
Use one of the following commands on the Kerberos server (usually a Microsoft Active Directory server) on a command prompt:
Important Note: Whatever directory you are in when you run the command is where the OUTPUT.TXT file will be generated.
ldifde -m -f OUTPUT.TXT
This will produce a file called OUTPUT.TXT with all of the Active Directory contents.
ldifde -f check_SPN.txt -t 3268 -d "" -l servicePrincipalName -r "(servicePrincipalName=krbsvr400/*)" -p subtree
This will produce a file called check_SPN.txt with just the krbsvr400 entries in Active Directory
You can browse the entries returned and search for duplicate service principal names (generally labled "User Logon Name" in Active Directory entries).
[{"Type":"MASTER","Line of Business":{"code":"LOB57","label":"Power"},"Business Unit":{"code":"BU058","label":"IBM Infrastructure w\/TPS"},"Product":{"code":"SWG60","label":"IBM i"},"Platform":[{"code":"PF012","label":"IBM i"}],"Version":"7.1.0"}]
Historical Number
390345113
Was this topic helpful?
Document Information
Modified date:
18 December 2019
UID
nas8N1019073