IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

v
When
a
problem
occurs,
consider
enabling
trace
for
SPNEGO.
Add
an
entry
to
the
routing
file.
The
routing
file
is
located
under
the
installation
directory,
in
etc/routing.
Example
entry:
bst:*.9:TEXTFILE:WebSEAL_installation_directory/log/spnegotrace.log
On
UNIX,
the
default
WebSEAL
installation
directory
is
/opt/pdweb.
Substitute
the
path
for
your
installation
directory.
Stop
and
restart
WebSEAL.
Look
for
error
messages
in
the
trace
file.
v
Problem:
The
WebSEAL
server
will
not
start.
The
log
file
contains
an
error
saying
″Authentication
method
(kerberosv5)
is
not
configured.″
Solution:
Enable
the
kerberosv5
authentication
method
in
the
[authentication-mechanisms]
stanza
in
the
WebSEAL
configuration
file.
v
Problem:
The
WebSEAL
server
will
not
start.
The
error
message
is
″The
security
service
function
gss_import_name
returned
major
error
code
131072
and
minor
error
code
-1765328168.″
Solution:
The
principal
name
specified
in
the
configuration
file
was
invalid.
It
should
have
the
form
″HTTP@host_name″
where
host_name
is
the
fully
qualified
DNS
name
of
a
computer
which
is
configured
into
the
Kerberos
realm.
v
Problem:
The
WebSEAL
server
does
not
start.
The
error
message
is:
″The
security
service
function
gss_acquire_cred
returned
major
error
code
851968
and
minor
error
code
39756033″.
Solution:
The
principal
name
in
the
configuration
file
does
not
match
any
of
the
keys
in
the
specified
keytab
file.
The
keys
in
the
keytab
file
have
names
like
HTTP/host_name
@REALM.
The
principal
name
should
have
the
format
HTTP@host_name
v
Problem:
The
WebSEAL
server
does
not
start.
The
error
message
is
″HPDST0129E
The
security
service
function
gss_acquire_cred
returned
major
error
code
851968
and
minor
error
code
486484225.
(pd
/
bst)″
or
″HPDST0129E
The
security
service
function
gss_acquire_cred
returned
major
error
code
851968
and
minor
error
code
39756033.
(pd
/
bst)″
Solution:
These
errors
are
caused
by
DNS
reverse
lookup
problems.
Verify
that
your
reverse
lookup
works
properly.
v
Problem:
When
a
user
attempts
to
access
WebSEAL
they
receive
an
error
saying
″HPDIA0100E
An
internal
error
has
occurred.″
The
WebSEAL
trace
log
file
contains
a
message
saying
″The
security
service
function
gss_accept_sec_context
returned
major
error
code
851968
and
minor
error
code
-1765328347.″
Solution:
the
system
clock
on
the
client
machine
is
out
of
sync
with
the
system
clock
on
the
WebSEAL
server.
You
must
keep
clocks
synchronized
when
using
Kerberos.
For
a
permanent
solution,
deploy
some
kind
of
time
synchronization
service
on
your
machines.
For
a
temporary
solution,
adjust
the
clocks
on
the
machines
so
they
are
within
one
minute
of
each
other.
244
IBM
Tivoli
Access
Manager
for
e-business:
WebSEAL
Administration
Guide