Hi
We implemented SAP Single Sign on last year using Kerberos and it was working beautifully until last Friday.
Since Last friday, we are getting a weird error on our development system( We are lucky that it has not started happening on our Production systems)...
Sapgui 710 [Build 9003] Tue Aug 24 16:27:16 2010
: 'SAP System Message:
Security Network Layer (SNC) error
Our configuration is:
snc/enable 1
snc/gssapi_lib /lib/libgssapi_krb5.a(libgssapi_krb5.a.so)
snc/identity/as p:SAPservice/sapdev.<domain_name>@<i5_REALM>
snc/accept_insecure_gui 1
snc/accept_insecure_rfc 1
snc/accept_insecure_r3int_rfc 1
snc/permit_insecure_start 1
Now the funny part is that we know what the fix is..We have to advance our PC clocks on the PC to maybe a couple of minutes ahead and then it lets us log into the system.
The Work process trace file shows us the following :
N Sun Aug 22 10:45:10 2010
N *** ERROR => SncPEstablishContext()==SNCERR_GSSAPI [sncxxall.c 3357]
N GSS-API(maj): Miscellaneous failure
N GSS-API(min): Clock skew too great <<<<<<========================
N Unable to establish the security context
N <<- SncProcessInput()==SNCERR_GSSAPI
M *** ERROR => ThSncIn: SncProcessInput (SNCERR_GSSAPI) [thxxsnc.c 976]
M *** ERROR => ThSncIn: SncProcessInput [thxxsnc.c 981]
M in_ThErrHandle: 1
M *** ERROR => ThSncIn: SncProcessInput (step 4, th_errno 44, action 1, level 1) [thxxhead.c 10631]
Looking at it, someone will wonder that its the clcok skew and that its off.
But we have looked at the iSeries clock, the domain controller clock and the PC clcok, which are all within minutes of each other. The iseries is synced to the domain using CHGNTPA every 60 minutes using (*MAXADJ).
Also Our domain controller setting for Kerberos Policy for Maximum tolerance for computer clock synchronization is set to 5 minutes.
Now it even get's more interesting. We have three SAP systems on the same lpar configured for SAP SNC SSO.
one of them works and two of them gies us this error. When we advance our PC times by only a couple of minutes, then these two also start working.
So that make us believe, it must be something within the SAP application, as all three share the same OS configuration.(time, REALMS, krb5 settings etc). The one that works is a BI system and is at SPS 15, but the two that give us trouble are at SPS11.
Any advise on where i should look further inside SAP??? System i??
I am all stumped...
Thanks in advance for all your help.
Abhi
Edited by: ABHI GUPT on Aug 27, 2010 11:23 AM
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.