SNCERR_CONTEXT_EXPIRED during Citrix Timezone redirection

[Former Member]

Hello,

We have a environment to provide connectivity to our remote users. They can join the local environment using RDP or VDI to connect to our systems when VPN  access is not possible. Everything works well but when we activate the time-zone redirection feature SSO stops working if time-zone of the remote user is equal to or greater than 10 hours (as this is the lifetime of the Kerberos tickets).

Error we get is SNCERR_CONTEXT_EXPIRED.

I have already tried all the standard available solutions and a incident is already opened with SAP but so far no solution there.

I hope to get some help here.

Thanks.

Anand

[Former Member]

After a lot of reading here and there we came to know that Microsoft Kerberos does not enforce security context expiration on message protection calls, so it is possible to completely disable security context lifetime reporting for gsskrb5.dll through this little registry tweak:

SubKey:  HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\SAP\gsskrb5

Entry:   ForceCtxNoExpire

Type:    REG_DWORD

Value:   1   (default is 0)

Above mentioned registry key addition worked for us.

Thanks you all.

Kind Regards

Anand

[Former Member]

Thanks for the additional information Anand.  I did try the changes in our Citrix environment, and it didn't work. 

Best Regards,

Robin

[Former Member]

Hi Anand,

I am facing the same issue.  Did you ever get a resolution on your issue?

Thanks,

Robin

[tim_alsop]

Robin

Which SNC library are you using on Citrix Server (same host as SAP GUI) and on host running AS ABAP ?

Thanks

TIm

[Former Member]

Hi Tim,

I get the issue whether I'm logged directly into the Citrix server or through the host. In my case, I've been testing exclusively on the Citrix Server to try and resolve the issue.  I've tested using the latest GUI and SNC libraries and turning off the Time-zone redirection is not something we can do.

Thanks for the response,

Robin

[Former Member]

Hello Robin,

No solution so far, after a lot of analysis issues seems to be related to SNC library provided by ouyr SSO provider. Waiting for them to update the DDL..

Anand

[Former Member]

Robin,

from where you got the latest SNC library?

Anand

[tim_alsop]

Robin

I helped Anand confirm that the SNC library he is using was causing this issue. I showed him that using our SNC library that the problem doesn't occur. He is therefore waiting for his vendor to fix the issue in their library. <deleted by moderator>

Thanks

Tim

[Former Member]

Hi Tim,

In working with the BASIS team, it looks like we have a similar issue where the SNC DLL is outdated.

Thank you for chiming in, as it helped confirm our findings.

Robin

[Former Member]

Thanks for the info Anand.  Seems to be a similar issue for us as well.

Cheers, Robin