Troubleshooting

This troubleshooting information includes common problems for network authentication service, Enterprise Identity Mapping (EIM), and IBM-supplied applications that support Kerberos authentication.

1. Complete all prerequisites.

2. Ensure that the user has a user profile on the System i™ platform and a principal on the Kerberos server. On the System i platform, verify that the user exists by opening the Users and Groups in iSeries™ Navigator or typing the WRKUSRPRF (Work with User Profile) command on a command line. On Windows^® systems, verify the user exists by accessing the Active Directory Users and Computers folder.

3. Check to see if the System i platform is contacting the Kerberos server by using the kinit command from Qshell Interpreter. If the kinit command fails, check to see if the i5/OS^® service principal has been registered on the Kerberos server. If it has not, you can add the i5/OS principal to the Kerberos server.

• Network authentication service errors and recovery
  While using the Network Authentication Service wizard or when you are managing network authentication service properties in iSeries Navigator, you might encounter these errors. Use the corresponding recovery methods listed here to troubleshoot.

• Application connection problems and recovery
  Here are some of the common errors in Kerberos-enabled i5/OS interfaces and their recovery methods.

• API trace tool
  You can set up the API trace tool to troubleshoot problems with Kerberos and Generic Security Services API calls.

• Troubleshooting Kerberos server in i5/OS PASE
  You can access status and informational log files to troubleshoot Kerberos server in i5/OS PASE.

Parent topic: