Problem with Kerberos SSO to SAP system

[Louis Scott]

We are having problems getting SSO to work to SAP systems running on RHEL 6.3. We have a number of systems running on RHEL 5.8, and SSO is working without any problems, but it is failing for some reason with the systems on the RHEL 6.3 systems.

The server and library information is:
> lsb_release -d
Description:    Red Hat Enterprise Linux Server release 6.3 (Santiago)

The following packages are installed:
   krb5-devel-1.9-33.el6_3.3.x86_64
   krb5-libs-1.9-33.el6_3.3.x86_64
   krb5-workstation-1.9-33.el6_3.3.x86_64
   pam_krb5-2.3.11-9.el6.x86_64
   libgssglue-0.1-11.el6.x86_64

The SAP system is running the 64-bit version of the 720_EXT Kernel, patch level 300.
SNC is enabled in the SAP system profile, the <sid>adm account can successfully acquire a TGT from the Active Directory system, and the SAP systems starts up without any SNC-related errors.

When we attempt to log in with SSO via SAP Gui, we see the following error in the SAP work process logs:

N  *** ERROR => SncPEstablishContext()==SNCERR_GSSAPI  [sncxxall.c 3357]
N        GSS-API(maj): No credentials were supplied, or the credentials were unavailable or inaccessible
N      Unable to establish the security context

The session settings in the SAP Gui indicate that SNC is active, and it is attempting to send a logon ticket for the correct SPN.

Has anyone had experience with something like this before? Any advice on next steps for troubleshooting would be appreciated?

Louis

---
Louis Scott
Basis Administrator
3495 Kent Avenue
West Lafayette, IN 47906
765.494.2400