GUI SNC logon failing intermittently with sec_avail="false" messages

[Former Member]

Greetings All,

We are using SAPGUI SNC logon with the GSSKRB5.DLL library as described in Note 352295.

Occassionally, users get this message when trying to access any system via SNC logon:

: 'SNCERR_GSSAPI 
An operation failed at the GSS-API level 
sec_avail="false" 

Time Thu Oct 09 14:07:49 2008 
Component SNC (Secure Network Communication) 
Release 710 
Version 5 
Module sncxx.c 
Method SncInit 
Return Code -4 
Counter 2

Activating a trace in the GUI will show this error message in the sapni_*.trc file:

*** ERROR => SncPAcquireCred()==SNCERR_GSSAPI  [sncxxall.c 1428] 
      GSS-API(maj): No valid credentials provided (or available) 
      GSS-API(min): No Kerberos SSPI credentials available for requested name 
    Could't acquire DEFAULT INITIATING credentials 

*** ERROR => ErrISetSys: error info too large [err.c ;       944] 
Thu Oct 09 14:07:27 2008 
LOCATION     
ERROR       GSS-API(maj): No valid credentials provided (or available) 
GSS-API(min): No Kerberos SSPI credentials available for requested nam 
Could't acquire DEFAULT INITIATING credentials 

TIME        Thu Oct 09 14:07:27 2008 
RELEASE     710 
COMPONENT   SNC (Secure Network Communication) 
VERSION     5 
RC          -4 
MODULE      sncxxall.c 
LINE        1428 
DETAIL      SncPAcquireCred 
SYSTEM CALL gss_acquire_cred 
ERRNO        
ERRNO TEXT   
DESCR MSG NO 
DESCR VARGS GSS-API(maj): No valid credentials provided (or available);;;; 
;;;;GSS-API(min): No Kerberos SSPI credentials available for requested nam;;;; 
;;;;Could't acquire DEFAULT INITIATING credentials 

DETAIL MSG N 
DETAIL VARGS 
COUNTER     1 
SncInit(): Fatal -- Initiating Credentials not available! 
<<- ERROR: SncInit()==SNCERR_GSSAPI 
         sec_avail = "false" 
*** ERROR => TmConnect2: SncInit (SNCERR_GSSAPI) [dpxxtm.c ;    833]

I am not able to isolate why some users encounter this problem. They may be able to access systems fine at one point, and then an hour later, they will start recieving the errors above. Logging off and back on to the computer will fix the problem, although waiting long enough (maybe the next day) will usually result in the problem going away. The problem will usually occur again in a few days or weeks. Some users never have the problem. I cannot locate any error on the SAP application server side, which is understandable since the GUI error indicates that initiating credentials could not even be acquired.

The issue appears with version 1.0.8 and 1.0.9 of the gsskrb5.dll. The client computers are all Windows XP SP2 and include the fix mentioned in Microsoft Hotfix 885887.

I would greatly appreciate any help in troubleshooting this issue.

Regards,

Zac Elliott

[Former Member]

We have the exact same issue. Please let me know if you find answer to this issue.

Cheers

Mandeep

[Former Member]

Mandeep,

One issue that occurs in our environment is Kerberos tickets on the PC not renewing. You may want to use KLIST or KERBTRAY in the Windows Resource Toolkit to check this when the problem is occuring. The tickets sometimes do not renew for various reasons in our environment, and logging off and back on to the computer at least every couple of days seems to be the easiest fix.

Sometimes, though, the problem occurs when the tickets are still current, so I have not been able to find the cause for this.

Hope this helps a little.

-Zac