Policy failed using AD identity provider: Authentication required, error log: "KrbException: Checksum failed"
Article ID: 274681
Updated On:
Products
CA API Gateway
Issue/Introduction
Failed to authenticate using AD identity provider. SSG log is showing error:
8200: Could not process Kerberos token (Negotiate); error is 'KrbException: Checksum failed'
Environment
API Gateway 9.x, 10.x, 11.x
Cause
"KrbException: checksum failed" message occurred because the customer is using the SPN with HTTP instead of http (uppercase vs lowercase).
Resolution
Regenerate the keytab file using the correct SPN (with lowercase http):
ktpass –princ http/<Gateway_Cluster_Hostname>@DOMAIN.COM –mapuser <user_Name> -pass <user_Password> –out <keytab_Name>
Feedback
Yes
No
Powered by
