Authentication failed. Cannot get kdc for realm

Question

There is something missing from the log file that I need to see. When a user logs in you should see what was submitted in the std.out (since you have enabled JDK tracing with debug=true in the bsclogin.conf)
"Cannot get kdc for realm ECM-INC.COM"
Without seeing the entire error message it seems that java cannot communicate with the KDC you have defined under the ECM-INC.COM realm (this would be the suspect KDC ECM-ADC.ECM-INC.COM) can you ping it? is it a domain controller?, is the global catalog enabled?
run the set command from a DOS window and try replacing that ECM-ADC part with the value in the logon server (all CAPS).
Also verify the problem exists by typing BOinstall\javasdk\bin\kinit username
Regards,
Tim

Answer 1

Hi Tim,
I am getting the following error, I have a case in with SAP but have not recieved a response. I noticed that you are an SAP employee, is it possible to get you involved with my case? Either way below is the error I'm getting.
C:\Program Files (x86)\Business Objects\javasdk\bin>kinit.exe CHI\biadauth
Password for CHI\[email protected]:######
Exception: krb_error 6 Client not found in Kerberos database (6) Client not foun
d in Kerberos database
KrbException: Client not found in Kerberos database (6)
        at sun.security.krb5.KrbAsRep.<init>(KrbAsRep.java:66)
        at sun.security.krb5.KrbAsReq.getReply(KrbAsReq.java:486)
        at sun.security.krb5.KrbAsReq.getReply(KrbAsReq.java:444)
        at sun.security.krb5.internal.tools.Kinit.sendASRequest(Kinit.java:310)
        at sun.security.krb5.internal.tools.Kinit.<init>(Kinit.java:239)
        at sun.security.krb5.internal.tools.Kinit.main(Kinit.java:106)
Caused by: KrbException: Identifier doesn't match expected value (906)
        at sun.security.krb5.internal.KDCRep.init(KDCRep.java:133)
        at sun.security.krb5.internal.ASRep.init(ASRep.java:58)
        at sun.security.krb5.internal.ASRep.<init>(ASRep.java:53)
        at sun.security.krb5.KrbAsRep.<init>(KrbAsRep.java:50)
        ... 5 more
A little bit of background on this. We use a single lable domain with multiple forest and multiple domains in those forest. I realize that the kinit.exe tool only test a single domain so I picked out only one domain to test with but I still get the error above. Any thoughts?
Thanks,
Tammy