SSO Kerberos SPNego fails in step2

[Former Member]

when configuring SSO using the SPNego wizard, in step2, I get the error below:

"Search by service user mapping attribute krb5principalname=host/m2003172dvm$@MYCOMPANY.COM failed; check the mapping attribute and the UME configuration"

I applied all the configuration from http://help.sap.com/erp2005_ehp_03/helpdata/EN/43/4bd58c6c5e5f34e10000000a1553f6/content.htm

and, from Config Tool, I can test the connection to the Active Directory successfully.

[Former Member · Accepted solution]

hello,

apparently the spnego wizard can not find the service user

in the configured user path and group path on the active

directory server ADS.

In the UME Ldap data (configtool) you need to configure as well

user path and group path -> if you click on "browse" you can see

if your service user is in the user path/group path. There is as well

the option deep directory or flat directory structure. Ask your

NT Administrators how this should be setup.

With "test authentification" you can find out if your service user

and other users can logon to the ADS.

kr,

andreas

[Former Member]

>

> when configuring SSO using the SPNego wizard, in step2, I get the error below:
> 
> "Search by service user mapping attribute krb5principalname=host/m2003172dvm$@MYCOMPANY.COM failed; check the mapping attribute and the UME configuration"
> 
> I applied all the configuration from http://help.sap.com/erp2005_ehp_03/helpdata/EN/43/4bd58c6c5e5f34e10000000a1553f6/content.htm
> 
> and, from Config Tool, I can test the connection to the Active Directory successfully.

Why is there a "host/" in front of your KRB5 principle name? What did you put in the field as the user? Shouldn't it only be the user@domain? the user name you have above "host/m2003172dvm$" looks really weird.