SSO not working with SSL enabled(IIS)

server administration XI Server Discussion
1

Hi Guy,

if i enable SSL on my Infoview and Opendocument , my sso is not working.

I am getting this error message

Account Information Not Recognized: An error has occurred propagating the security context between the security server and the client. Please contact your system administrator.

Is it my cert? I have install the CA root cert inside my client.I dont know what is wrong here.I check my cert is valid.

jeffreyl (BOB member since 2008-08-08)

2

problem solved…i forget to add the HTTPS site to my trusted zone:)

jeffreyl (BOB member since 2008-08-08)

3

Hi,

I am trying to get SSO working period. I’ve followed all the admin documenations and changed the necessary parameters in the web.config file, but when I try to SSO i get an error:

Account Information Not Recognized: Single Sign On Failed. Please Try Again.

I have verified that my account is mapped into the AD group in BO, and that SSO is turned on in CMC. All the IIS manager settings (Integrated Authentication) has been set.

Is there anything else with XI 3.1 IIS AD Authentication SSO that I should be aware of?

dehuang83 :afghanistan: (BOB member since 2006-01-18)

4

quick check, is your AD authentication login working for CMC and infoview?

jeffreyl (BOB member since 2008-08-08)

5

Yes I can login manually via AD in CMC and .NET InfoView, but Cannot do so with SSO.

dehuang83 :afghanistan: (BOB member since 2006-01-18)

6

if that is the case.

  1. check and check ensure all the parameter are corrects( i have made mistakes a few time changing those web.config file)
  2. i use wireshark(free packet sniffing tools) to check the kerberos packet.
    run wireshark and login to create the error message.look for “kerberos” packet and see for error message thrown.
  3. also check the event viewer of the domain controller for and error message related to the SSO login.

This are what i have done as solved my problem successfully.My problem was duplicate SPN which was setup with the same name.I had to manually remove them using adsiedit and reset the spn to default.:slight_smile:
Cheers…

jeffreyl (BOB member since 2008-08-08)