AD login with Java (FWM 00006)

server administration XI Server Discussion
1

I am working to solve an issue with users attempting to login to InfoView or the CMC on an XI 3.1 server running Tomcat 5.5. The error is as follows:

“Account Information Not Recognized: Active Directory Authentication failed to log you on. Please contact your system administrator to make sure you are a member of a valid mapped group and try again. If you are not a member of the default domain, enter your user name as UserName@DNS_DomainName, and then try again. (FWM 00006)”

I have added the debug=true to the bscLogin.conf, and there are no entries in the stdout.log file. I added -Dcrystal.enterprise.trace.configuration=verbose to the Java options and do not see a jce_verbose.log in the profile for the service account.

I can login using Designer or DeskI without errors.

The OS is Windows Server 2008 r2 and the browser is IE7.

I could use some suggestions with this one, please.

aroche :us: (BOB member since 2006-06-06)

2

Hi aroche

You can check this link and search other threads for more information.

Strange thing is - You are not getting logs in the stdout.log file. This clarly means that either the code inside bscLogin.conf is wrong.

or Tomcat is not able to access bscLogin.conf or krb5.ini.

Solution 1: Check code

com.businessobjects.security.jgss.initiate {
com.sun.security.auth.module.Krb5LoginModule required debug=true;
};

Solution 2: Make sure that Java options are correctly set inside Tomcat

-Djava.security.auth.login.config=C:\winnt\bscLogin.conf
-Djava.security.krb5.conf=C:\winnt\Krb5.ini

:wave:

nicholas (BOB member since 2008-07-31)

3

Thanks, nicholas.

I had already done the search and read that thread, and many others to boot.

I did finally find the problem and it was simply that initiate is not spelled “initate”. It took me almost 24 hours to notice that the third “i” was missing, and I even had several other people review it because I thought it might be a typo or something.

sigh

aroche :us: (BOB member since 2006-06-06)

4

That’s why I trust Copy-Paste as best option while configuring SSO. :lol:

nicholas (BOB member since 2008-07-31)

5

I hear you there. I have a complete document with all the steps and code needed so that I can CnP it. However, due to security constraints I was forced to access the server in a way that the clipboard was not linked and I had to type everything. The krb5.ini was a bear to make sure it was accurate.

Of course the short file that never changes? Yeah, that was the one I typo’d. :lol:

aroche :us: (BOB member since 2006-06-06)