SNCERR_GSSAPI (Fatal: Accepting Credentials not available)

[Sandeep K]

Hi,

The SAP ECC system is not coming up when I add the below mentioned
parameters in the Instance profile. The issue I have identified it is
database is coming up but SAP application is not and all the work process
are in ended stated and message server & dispatcher are not coming up in the
system.

The SNC Parameters are...

snc/enable =1
snc/identity/as=p:SAPServiceSID/abcdevde1.abc.no at ABC.NO
snc/accept_insecure_gui=1
snc/gssapi_lib = /usr/lib/libgssapi_krb5.a (libgssapi_krb5.a.so)

Kindly,see the work process developer trace log details...

N SncInit(): Initializing Secure Network Communication (SNC)
N IBM RS/6000 with AIX (st,ascii,SAP_UC/size_t/void* = 16/64/64)
N SncInit(): found snc/data_protection/max=3, using 3 (Privacy Level)N
SncInit(): found snc/data_protection/min=2, using 2 (Integrity Level)
N SncInit(): found snc/data_protection/use=9, using 3 (Privacy Level)N
SncInit(): found
snc/gssapi_lib=/usr/lib/libgssapi_krb5.a(libgssapi_krb5.a.so)
N File "/usr/lib/libgssapi_krb5.a(libgssapi_krb5.a.so)" dynamically
loaded as GSS-API v2 library.
N The internal Adapter for the loaded GSS-API mechanism identifies as:
N Internal SNC-Adapter (Rev 1.0) to Kerberos 5/GSS-API v2
N SncInit(): found
snc/identity/as=p:SAPServiceSID/abcdevde...@ABC.NO
N *** ERROR => SncPAcquireCred()==SNCERR_GSSAPI http://sncxxall.c 1439
N GSS-API(maj): Miscellaneous failure
N GSS-API(min): No such file or directory
N Could't acquire ACCEPTING credentials for
N name="p:SAPServiceSID/abcdevde...@ABC.NO"
N SncInit(): Fatal -- Accepting Credentials not available!
N <<- SncInit()==SNCERR_GSSAPI
N sec_avail = "false"
M ***LOG R19=> ThSncInit, SncInitU ( SNC-000004) http://thxxsnc.c 230
M *** ERROR => ThSncInit: SncInitU (SNCERR_GSSAPI) http://thxxsnc.c 232
M in_ThErrHandle: 1
M *** ERROR => SncInitU (step 1, th_errno 44, action 3, level 1)
http://thxxhead.c 10651

Kindly,look in to the issue and suggest the solution.

OS : AIX 6.1
SAP : SAP Netweaver EHP1
Database : IBM DB2 9.5

Thanks & Regards
Sandeep

[Vipin Rathor]

Based on this:

> N *** ERROR => SncPAcquireCred()==SNCERR_GSSAPI http://sncxxall.c 1439
> N GSS-API(maj): Miscellaneous failure
> N GSS-API(min): No such file or directory
> N Could't acquire ACCEPTING credentials for
> N name="p:SAPServiceSID/abcdevde...@ABC.NO"

it is evident that the cred. acquire for
SAPServiceSID/abcdevde...@ABC.NO principal is failing.
Please check whether u have a "valid TGT" for this principal before
calling the application.
Are u able to do kinit using this principal?

Additionally, check if the keytab entries for SAPServiceSID/... are correct.
What does the 'klist -ke' show?

Hope this helps.

--
- Rathor

> N SncInit(): Fatal -- Accepting Credentials not available!

> N <<- SncInit()==SNCERR_GSSAPI
> N sec_avail = "false"
> M ***LOG R19=> ThSncInit, SncInitU ( SNC-000004) http://thxxsnc.c 230
> M *** ERROR => ThSncInit: SncInitU (SNCERR_GSSAPI) http://thxxsnc.c 232
> M in_ThErrHandle: 1
> M *** ERROR => SncInitU (step 1, th_errno 44, action 3, level 1)
> http://thxxhead.c 10651
>
> Kindly,look in to the issue and suggest the solution.
>
> OS : AIX 6.1
> SAP : SAP Netweaver EHP1
> Database : IBM DB2 9.5
>
> Thanks & Regards
> Sandeep

> ________________________________________________
> Kerberos mailing list � � � � � Kerb...@mit.edu
> https://mailman.mit.edu/mailman/listinfo/kerberos
>

[Sandeep K]

Hi Vipin,

I apologies for the very late reply regarding the Kerberos issue as I'm on
long vacation.

The below issue is resolved. I have edited the krb5.conf in that I have
changed the keytab file name in the default path.Kindly,see the path,

Previous path : default_keytab_name = FILE:/etc/krb5/krb5.keytab
Current path in the file : default_keytab_name =
FILE:/etc/krb5/SAPServiceDE1.keytab

In the krb5.conf I have changed only krb5.keytab file name.
After changing to the current path the issue gets resolved in the system.

Thank you very much for the kind support.

Thanks & Regards
Sandeep.