My user AD accounts will login to CMC but not the AD account that the server runs with

Phillip Putzback Apr 25, 2012 9:59 PM

Currently Being Moderated

Is this normal?

I have a svc_Bosso account created in AD and it runs everything according to the SSO authentication guide used to setup the server. I can use that AD account to login the Web intelligence tools but not the CMC. The account is an admin, and everything else works fine. The error I get it is.

Account Information Not Recognized: Active Directory Authentication failed to log you on. Please contact your system administrator to make sure you are a member of a valid mapped group and try again. If you are not a member of the default domain, enter your user name as UserName@DNS_DomainName, and then try again. (FWM 00006)

I have a Business_Users group in AD that includes the service account and that is in the list on the CMC Authentication/Windows AD mapped AD member groups.

If I got to users and groups svc_Bosso is in the user list. I I right click and select member OF I see administrators, Domain\Business_Users and everyone.

Any ideas why I can't login to the CMC?

Re: My user AD accounts will login to CMC but not the AD account that the server runs with

Vikram Veeranagari Apr 26, 2012 4:26 PM (in response to Phillip Putzback)

Currently Being Moderated

Hello Phillip,

How are you trying to log into CMC? Is it svc_Bosso@DOMAIN.COM or domain\svc_Bosso ?

The latter wont work for CMC or Infoview. The client tools will work though.

Also is the service account and other users coming from the same AD domain?

Regards,

Vikram.V
Report Abuse

Like (0)
- Re: My user AD accounts will login to CMC but not the AD account that the server runs with
  
  Phillip Putzback Apr 26, 2012 4:46 PM (in response to Vikram Veeranagari)
  
  Currently Being Moderated
  
  Yes, I am trying to log into the CMC. I tried every variation of the format you mentioned and I still get the 00006 error.
  
  Report Abuse
  
  Like (0)
  - Re: My user AD accounts will login to CMC but not the AD account that the server runs with
    
    Vikram Veeranagari Apr 26, 2012 11:58 PM (in response to Phillip Putzback)
    
    Currently Being Moderated
    
    Does kinit <service account> successfully fetch a ticket?
    Can a different user login from your machine?
    
    The following SAP KBA can help:
    
    1476374 - ***Best Practices*** including Basic and Advanced AD Troubleshooting Steps for Manual Logon, NTLM, Kerberos and Vintela Single Sign On
    
    -Vikram
    
    Report Abuse
    
    Like (0)
Re: My user AD accounts will login to CMC but not the AD account that the server runs with

Julian Jimenez Apr 27, 2012 11:49 AM (in response to Phillip Putzback)

Currently Being Moderated

Hi,

I've seen this behaviour before when everything works fine except the service account. The first thing I would ask you is why do you need to log with a service account as long as all your users can log in normally?

It suppose that you might have a problem with the service account kerberos tickets in the server. Tomcat obtains a ticket for the service account when it starts. If you are using a keytab, try using the password instead in the Java parameters in Tomcat.

Regards,
Julian
Report Abuse

Like (0)
- Re: My user AD accounts will login to CMC but not the AD account that the server runs with
  
  Phillip Putzback Apr 27, 2012 5:47 PM (in response to Julian Jimenez)
  
  Currently Being Moderated
  
  I am using a password hardcoded in the java parameters. But I am not requried to login with that accoutn for any reason that I know of yet. It was mreo about testing the accounts rights.
  Thanks,
  Phil
  
  Report Abuse
  
  Like (0)
  - Re: My user AD accounts will login to CMC but not the AD account that the server runs with
    
    Rohit Vamsi Apr 28, 2012 12:43 AM (in response to Phillip Putzback)
    
    Currently Being Moderated
    
    Did you run the kinit command for the service account and check whether you were able to get the ticket ?
    
    Report Abuse
    
    Like (0)
    - Re: My user AD accounts will login to CMC but not the AD account that the server runs with
      
      Phillip Putzback Apr 29, 2012 1:12 AM (in response to Rohit Vamsi)
      
      Currently Being Moderated
      
      We are getting tickets. Since it is more of a quirk than anything and seeing as it isn't holding us up I am going to stop while I am ahead.
      
      Thanks for the help.
      
      Report Abuse
      
      Like (0)

Go to original post