SSPI::IniSctx#1()==Specified target is unknown or unreachable

[Former Member]

Dear all,

we're in the process of implementing SSO for SAP Application servers on our IBM AIX infrastructure.

We tried doing it before, using the embedded AIX's Kerberos libraries, found on the expansion DVD, but we got into some issues and - thanks to the community's answers ( see the thread "http://scn.sap.com/thread/3177029" ) - we choose not to going on further with that option.

We - then - moved to the SAP NetWeaver Single Sign-On product area and we install on our server the Secure Login Library; after the setup, we started the instance and everything seemed to work fine.

We choose a user as a test case, and we configured in its properties the SNC name, as follows:

After that, we configured our SAPGUI client with the same name, in the connection properties, as follows:

Once we try to login, however, we receive an error via popup that state ( taken from the trace 😞

*** ERROR => SncPEstablishContext() failed for target='p:CN=USERNAME@DOMAIN.LOCAL' [sncxxall.c 3379]

*** ERROR => SncPEstablishContext()==SNCERR_GSSAPI  [sncxxall.c 3345]

      GSS-API(maj): Miscellaneous Failure

      GSS-API(min): SSPI::IniSctx#1()==Specified target is unknown or unreachable

    Unable to establish the security context

    target="p:CN=USERNAME@DOMAIN.LOCAL"

<<- SncProcessOutput()==SNCERR_GSSAPI

*** ERROR => TmIWrite: SncProcessOutput (SNCERR_GSSAPI) [dpxxtm.c     1782]

*** ERROR => TmIConnect: TmIWrite [dpxxtm.c     948]

TM_LAYER TmConnect <<

Prior to that, obviously, we installed and configured on the client the SAPSSO.zip package downloaded from the SAP Service Marketplace, which placed the "gsskrb5.dll" library under the "System32" folder, and created the environment variable that points to it.

Did we miss something in the configuration?

The client workstation from where we tried the connection, is a member of the "DOMAIN.LOCAL" domain, as well as the user.

We also tried to set the SPN in Active Directory ( according to what is set on the SAPGUI ), with poor results.

We don't think it's necessary to install the SAP NetWeaver Single Sign-On client also, but if that's the case, we won't have problem doing so.

Regards,

Luciano

[tim_alsop]

Luciano,

In the other thread you asked me to look at this thread. Although I can help you with this issue, I have been told that my response would be considered as commercial spam, so I cannot post it. Sorry, but it seems that there are certain SCN rules I have to follow.

Thanks,

Tim

[Former Member]

Dear Tim,

thanks for your always quick answers..

I think I might come across the post you're referring to..

However, I think that you can answer to my question, as per your knowledge, since they involve only SAP expertise, and not commercial stuff ( thus, we shouldn't go against SCN rules )..

Questions that I post again:

- did we miss something in the aforementioned configuration?

- is it necessary to install SAP Secure Login Client on the workstations, or it's enough having the SAP Kerberos library?

Regarding the 1st question, in fact, I just need to know if - on the client-side - we might've missed something in the configuration..

About the 2nd, moreover, I'm not asking you to suggest me that I might solve my problem with the solution you're selling ( which would be against the rules ), but simply if I need another SAP component to have the configuration working or not.

Anyway, if you think you're not able to answer w/o breaking the rules, I surely won't and I can't force you to do so.

Regards,

Luciano