Problem while integrating windows file server into SAP KM using WEBDAV

Question

Hi
I am trying to integrate windows file server into SAP KM using WEBDAV . I have downloaded the kerberos ini filter and included in the windows system. I am only trying to bring the files in the same system into KM but with no luck. When i check the log file in the kerberos folder i am getting
<b>12:02:22 10828/10476 E OnPreprocHeaders: Found 0 UserPrincipalNames for ADSI Filter (&(objectCategory=person)(objectClass=user) (userPrincipalName=xxxx))</b>.
In the log i am getting the following
ERROR! Delegation Flag:Use any authentication protocol: NOT ACTIVE
                       Open 'Active directory Users and Computers'. Choose <domain> -> 'Computers'.
                       Right-click 'IDBSRV8' and choose 'Properties'.
                       Select 'Delegation' and 'Trust this computer for delegation to specified services only'.
                       Select 'Use any authentication protocol'.
                ERROR! The Trusted-to-Authenticate-for-Delegation flag is not set for SPN 'HOST/idbsrv8.idbhq.org'.
                       Please check the SPN by calling 'setspn -l IDBSRV8'.
                       If the SPN is well known, configure the Trusted-to-Authenticate-for-Delegation flag:
                       Open 'Active directory Users and Computers'. Choose <domain> -> 'Computers'.
                       Right-click 'IDBSRV8' and choose 'Properties'.
                       Select 'Delegation' and 'Trust this computer for delegation to specified services only'.
                       Select 'Use any authentication protocol' and choose 'Add'.
                       Select 'Users or Computers' and enter IDBSRV8 as object name.
                       Add the ServicePrincipalName HOST/idbsrv8.idbhq.org.
Can anybody please help me in this regard???
Regards,
Ganesh N
Message was edited by:
        Ganesh Natarajan

Answer 1

Hi Ganesh,
this error message tells you that there is no user in your active directory that has the userPrincipalName xxxx.
The SSO22KerbMapModule works as follows.
1. It receives a SAP Logon Ticket from the WebDAV request.
2. If valid the SAP username is extracted. In your case the SAP username is xxxx.
3. It then searches for a user in AD. It does so using the attribute in the ini-file that has been specified to contain the SAP username. In your case the SAP username should be identical with the userPrincipalName.
So you have to make sure that the portal user id (j_user) is mapped to the same AD user attribute  that is specified in the ini-file .
Best regards,
Andre