AW: Error in client with kerberos and SAP SSO

Barbat, Calin c.barbat at
Mon Feb 21 06:06:43 EST 2005

Hi Juan,

no, I didn't have this problem before, but I assume that it has to do with the life-time of the user credentials in AD. Could be that there is a configuration option to say "Infinite", or so.
Did you look in the MS site? Perhaps they have a solution. "LSA-Cache refresh" could be something to look after.

Have a nice day,


-----Ursprüngliche Nachricht-----
Von: kerberos-bounces at [mailto:kerberos-bounces at]Im
Auftrag von Juan Manuel Sestelo
Gesendet: Freitag, 18. Februar 2005 16:25
An: Kerberos MIT
Betreff: Error in client with kerberos and SAP SSO

I have implemented an SSO solution with kerberos5, SNC, Active Directory 2K3 with SAP(Unix
Server). It Works fine, but I found an error in some clients that I want to investigate.

Some days, in the morning (note: users don't close the windows sessions at the end of work-day,
they block-out their computers), when users try to connect to SAP, they receive the following
client error (in the SAP client log):

Sapgui 620 [Build 8966] Wed Feb 16 10:03:14 2005: 'GSS-API(maj): No valid credentials provided (or
available) GSS-API(min): No Kerberos SSPI credentials available for requested nam
name="p:user at SITE.DOMAIN.COM"
Component	SNC (Secure Network Communication)
Release		620
Version		5
Module		sncxxall.c
Line		1223
Method		SncPAcquireCred
Return Code	-4
System Call	gss_acquire_cred
Counter		4

or this one:

Sapgui 620 [Build 8966] Tue Feb 15 10:21:59 2005 : 'SNCERR_GSSAPI
An operation failed at the GSS-API level sec_avail="false"
Component	SNC (Secure Network Communication)
Release		620
Version		5
Module		sncxx.c
Method		SncInit
Return Code	-4
Counter		2

The problem ends if the user close it windows session and start it again.
Someone knows this error? 

Thanks in advance!
Juan M Sestelo

Correo Yahoo!
Espacio para todos tus mensajes, antivirus y antispam ¡gratis! 
¡Abrí tu cuenta ya! -
Kerberos mailing list           Kerberos at

More information about the Kerberos mailing list