Kerberos SharePoint / K2 Error: 0xd KDC_ERR_BADOPTION

  • 25 September 2008
  • 1 reply
  • 18 views

Badge

Hello Community,


 


I am at a customer which has some Kerberos problems in his SharePoint/K2 environment.


 


Topology:


The Customer has a one SharePoint server with all roles and K2 2003 for Workflows on it and one SQL Server 2005. Windows Server 2003, SQL Server 2005 and SharePoint 2007 are up to date.


 


Problem:


The customer wants to have Kerberos as auth. protocol and therefore we have done the following steps to enable it:


 



  1. Enable Kerberos for SQL Server
    setspn -A MSSQLSvc/sql01.devdemo.de:1433 devdemo_svc_sql
    Restartet SQL Server
    Test it with
    : select auth_scheme, * from sys.dm_exec_connections
    Works!
    J


  2. Added the URL as a SPN
    setspn -A HTTP/intranet.devdemo.de devdemo_svc_app_intranet
    setspn -A HTTP/intranet devdemo_svc_app_intranet


  3. Created a SPN for the Application pool Account
    setspn –A….


  4. Enable Kerberos in the SharePoint Web Application auth provider


  5. Set Service Accounts “Account is trusted for delegation”


 


I tested with Fiddler if the User now uses Kerberos when he entered the SharePoint Site and he does so…


 


But we have still these Errors in the Event Log:


 


Event Type:      Error


Event Source:   Kerberos


Event Category:           None


Event ID:         3


Date:                25.09.2008


Time:               09:24:34


User:                N/A


Computer:        W01ABBP01


Description:


A Kerberos Error Message was received:


         on logon session euuser


 Client Time:


 Server Time: 7:24:34.0000 9/25/2008 Z


 Error Code: 0x18 KDC_ERR_PREAUTH_FAILED


 Extended Error:


 Client Realm:


 Client Name:


 Server Realm: eu


 Server Name: krbtgt/eu


 Target Name: krbtgt/eu@eu


 Error Text:


 File: e


 Line: 6c0


 Error Data is in record data.


 


For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


Data:


0000: 30 75 30 73 a1 03 02 01   0u0s¡...


0008: 0b a2 6c 04 6a 30 68 30   .¢l.j0h0


0010: 09 a0 03 02 01 17 a1 02   . ....¡.


0018: 04 00 30 0a a0 04 02 02   ..0. ...


0020: ff 7b a1 02 04 00 30 09   ÿ{¡...0.


0028: a0 03 02 01 80 a1 02 04    ... ¡..


0030: 00 30 21 a0 03 02 01 03   .0! ....


0038: a1 1a 04 18 45 55 2e 54   ¡...EU.T


0040: 41 4b 41 54 41 43 4f 52   AKATACOR


0048: 50 2e 43 4f 4d 6d 61 6c   P.COMmal


0050: 73 61 6d 61 30 21 a0 03   sama0! .


0058: 02 01 01 a1 1a 04 18 45   ...¡...E


0060: 55 2e 54 41 4b 41 54 41   U.CUSTOMER


0068: 43 4f 52 50 2e 43 4f 4d   CORP.COM


0070: 6d 61 6c 73 61 6d 61      user


 


Event Type:      Error


Event Source:   Kerberos


Event Category:           None


Event ID:         3


Date:                25.09.2008


Time:               09:22:52


User:                N/A


Computer:        W01ABBP01


Description:


A Kerberos Error Message was received:


         on logon session


 Client Time:


 Server Time: 7:22:52.0000 9/25/2008 Z


 Error Code: 0xd KDC_ERR_BADOPTION


 Extended Error: 0xc00000bb KLIN(0)


 Client Realm:


 Client Name:


 Server Realm: EU.TAKATACORP.COM


 Server Name: host/w01abbp01.eu.customer.com


 Target Name: host/w01abbp01.eu.customer.com@EU.CUSTOMER.COM


 Error Text:


 File: 9


 Line: ae0


 Error Data is in record data.


 


For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


Data:


0000: 30 15 a1 03 02 01 03 a2   0.¡....¢


0008: 0e 04 0c bb 00 00 c0 00   ...»..À.


0010: 00 00 00 03 00 00 00      .......


I already searched for a resolution and some Forum entry’s pointed, that this could be a problem with Cross Forest trust or some that the Client has two SPN’s. Hope that helps a little bit… Attached I have the Netdiag /v file from that server, that shows that everything is fine!?!


 


Questions:



  • Does anyone have seen these errors before?


  • Is there any further configuration for K2 or the Server necessary?


  • How can I check if the Server does not have two SPN’s?



 Hope someone solved this problem before…


 


Please contact me directly: andreas.haist@avanade.com 


 


Thanks,
Andreas


1 reply

Badge +10
dont worry about the bad option one.  But the preauth failed is odd.  Are you running the service account as local system?

Reply