Skip to main content

Troubleshooting Kerberos

Documentation Team
  • Updated

Troubleshooting Kerberos

SquaredUp DS Kerberos script

The SquaredUp DS Kerberos script Debug-SquaredUpKerberos.ps1 queries the Kerberos configuration.

To download and run the Kerberos script see Collecting diagnostic information

The results are shown on screen and when an issue is identified a message is displayed which you can use to resolve the issue, using the information in this article.

Please contact SquaredUp Support if you experience any problems and reply to the automatic response with the output of the SquaredUp DS Diagnostics (see Collecting diagnostic information) and, if possible, a screenshot of the problem.

If the Kerberos script doesn't identify any issues but you are still prompted by the browser for a username and password, see the end of this article.

Issues identified by the Kerberos Script

Other issues covered:

SPN 'HTTP/SquaredUpServer' exists but it is not registered to identity 'domain\SquaredUpAccount'

The script has identified an SPN for the SquaredUp server but it is not registered to the SquaredUp DS application pool identity. This may be because the SquaredUp DS application pool identity has been changed. Follow the steps below to reconfigure the SPNs for the new SquaredUp DS application pool identity.

Configuring SPNs for the SquaredUp server

HTTP service SPNs need to be configured for each SquaredUp server. It is important to know the SquaredUp DS application pool identity as this determines the account the SPN is registered to.

  1. On a domain controller, click on the Start button and type:

    command prompt

  2. Right-click on the Command Prompt icon and click Run as administrator.

  3. Type:

    SETSPN -S HTTP/SquaredUpServer domain\SquaredUpAccount

    SquaredUpServer should be replaced by the name of the server where SquaredUp DS is installed, and domain by your domain name.

    SquaredUpAccount should be replaced by the SquaredUp DS application pool identity.

    If the SquaredUp DS application pool is configured to use NetworkService, then the SquaredUpAccount is the computer account for the web server. For example, if SquaredUp DS is running on server webserver1.domain.local then use domain\webserver1.

    If you have configured SquaredUp DS to use a domain service account then this account should be used. For example, if your domain service account is domain\svc-squaredup then use domain\svc-squaredup.

    If you are unsure which account SquaredUp DS is configured to use, check the SquaredUp DS application pool configuration (How to check and modify the application pool identity).

  4. This may report Duplicate SPN found, aborting operation!. The output also very usefully shows the account that is already registered to the SPN. See Troubleshooting Duplicate SPNs and Duplicate SPN found - Troubleshooting Duplicate SPNs to delete the existing SPN and recreate it.

  5. Repeat these steps for the fully qualified domain name (FQDN) of the SquaredUp server:

    SETSPN -S HTTP/SquaredUpServer.domain.tld domain\SquaredUpAccount

    Where tld is the top level domain.

  6. Run the SquaredUp DS Kerberos script to see if any further problems are reported (see Collecting diagnostic information).

If you have another address that you use to browse to SquaredUp DS, for example in your bindings or in DNS Manager, you should create two further SPNs, one for the shorter address and another for the fully qualified domain name (FQDN).

If you have another address you use to access SquaredUp DS, for example a DNS alias or alternative binding, you should create two additional SPNs for this address, the shorter address and the fully qualified domain name (FQDN).

  1. On a domain controller click on the Start button type:

    Command Prompt

  2. Right-click on the Command Prompt icon and click Run as administrator

  3. Type:

    SETSPN -S HTTP/Hostname domain\SquaredUpAccount

    Where Hostname is the address you specified in DNS Manager,domain is your domain, and SquaredUpAccount is the domain service account that you set as the SquaredUp DS application pool identity.

  4. Check that it shows Updated Object. If it shows Duplicate SPN found, aborting operation! see Duplicate SPN found - Troubleshooting Duplicate SPNs

  5. Once complete, type the following for the fully qualified domain name (FQDN):

    SETSPN -S HTTP/Hostname.domain.tld domain\SquaredUpAccount

    Where tld is the top level domain.

  6. Check that it shows Updated Object. If it shows Duplicate SPN found, aborting operation! see Duplicate SPN found - Troubleshooting Duplicate SPNs

For more information see Troubleshooting Kerberos

SPN 'MSOMSdkSvc/SCOMServer' exists but it is not registered to identity 'domain\SCOMIdentity'

The script has identified an SPN for the SCOM server but it is not registered to the System Center Data Access Service run as account. This may be because the System Center Data Access Service run as account has changed. Follow the steps below to reconfigure the SPNs for the new System Center Data Access Service run as account.

Configuring SPNs for SCOM

MSOMSdkSvc service SPNs need to be configured for the SCOM server. It is important to know the System Center Data Access Service run as account as this determines the account the SPN is registered to. For more information see OpsMgr 2012: What should the SPN’s look like?

When load balancing SCOM (whether using Network Load Balancing or a hardware load balancer) all the SCOM servers must have their System Center Data Access service running as the same service account See the Service Principal Names section at the end of this Technet article.

  1. On a domain controller, click on the Start button and type:

    command prompt

  2. Right-click on the Command Prompt icon and click Run as administrator.

  3. Type the following to set the SPN for the server short address:

    SETSPN -S MSOMSdkSvc/SCOMServer domain\SCOMIdentity

    SCOMServer should be replaced by the name of the SCOM server, and domain by your domain name.

    SCOMIdentity should be replaced by the System Center Data Access Service run as account.

    If the System Center Data Access Service is running as Local System, then the account should be the computer account for the SCOM server.

    If the System Center Data Access Service is running as a service account then the account should be that service account.

    See Checking the System Center Data Access Service run as account.

  4. This may report Duplicate SPN found, aborting operation!. The output also very usefully shows the account that is already registered to the SPN. SeeSee Troubleshooting Duplicate SPNs and Duplicate SPN found - Troubleshooting Duplicate SPNs to delete the existing SPN and recreate it.

  5. Repeat these steps for the fully qualified domain name (FQDN) of the SCOM server:

    SETSPN -S MSOMSdkSvc/SCOMServer.domain.tld domain\SCOMIdentity

    Where tld is the top level domain.

  6. Run the SquaredUp DS Kerberos script to see if any further problems are reported (see Collecting diagnostic information).

"Checking the SquaredUp account delegation settings...FAIL The SquaredUp account AD entry (domain\SquaredUpAccount) is not configured for delegation to SPN 'MSOMSdkSvc/SCOMServer'"

The Kerberos script shows the following error:
"Checking the SquaredUp account delegation settings...FAIL
The SquaredUp account AD entry (domain\SquaredUpAccount) is not configured for delegation to SPN 'MSOMSdkSvc/SCOMServer'"
 
You need to configure delegation in the Active Directory from the SquaredUpAccount to the System Center Data Access Service account:
  1. On a domain controller, open Active Directory Users and Computers.
  2. Navigate to the SquaredUpAccount mentioned in the error message (this should be SquaredUp DS application pool account, see How to check and modify the application pool identity).
  3. Right-click on the account and select Properties.
  4. Click on the Delegation tab.  (If the Delegation tab is not there see Delegation tab is missing when carrying out delegation).
  5. Check Trust this user/computer for delegation to specified services only.
  6. Click Add, then Users or Computers.
  7. Locate the System Center Data Access Service account. The SCOM DAS identity account you need is shown on the Kerberos script output as "Determining SCOM identity for kerberos... OK ; OMSDK.Account=domain\SCOMIdentity"
  8. From the list of available services click on MSOMSdkSvc. Careful not to select MSOMHSvc, you need MSOMSdkSvc. If MSOMSdkSvc is not available follow The MSOMSdkSvc service is not listed when carrying out delegation.

  9. At this point we strongly recommend restarting the SquaredUp servers to clear any cached account information.
  10. Run the SquaredUp DS Kerberos script to see if this error has been resolved and if any further errors are reported (see Collecting diagnostic information).

Troubleshooting Duplicate SPNs

After running a SETSPN -S command you may see Duplicate SPN found, aborting operation!

The Kerberos script may fail with the message Found duplicate SPNs

See Duplicate SPN found - Troubleshooting Duplicate SPNs

 

How to configure SPNs when accessing SquaredUp DS via an address that is not the SquaredUp server name

This applies if:

  • You want to enable Windows authentication (single sign-on)
  • SquaredUp DS is not installed on SCOM management servers
  • You have another address you use to access SquaredUp DS, for example a DNS alias or alternative binding, which is not the SquaredUp server name.

If you have another address you use to access SquaredUp DS, for example a DNS alias or alternative binding, you should create two additional SPNs for this address, the shorter address and the fully qualified domain name (FQDN).

  1. On a domain controller click on the Start button type:

    Command Prompt

  2. Right-click on the Command Prompt icon and click Run as administrator

  3. Type:

    SETSPN -S HTTP/Hostname domain\SquaredUpAccount

    Where Hostname is the address you specified in DNS Manager,domain is your domain, and SquaredUpAccount is the domain service account that you set as the SquaredUp DS application pool identity.

  4. Check that it shows Updated Object. If it shows Duplicate SPN found, aborting operation! see Duplicate SPN found - Troubleshooting Duplicate SPNs

  5. Once complete, type the following for the fully qualified domain name (FQDN):

    SETSPN -S HTTP/Hostname.domain.tld domain\SquaredUpAccount

    Where tld is the top level domain.

  6. Check that it shows Updated Object. If it shows Duplicate SPN found, aborting operation! see Duplicate SPN found - Troubleshooting Duplicate SPNs

For more information see Troubleshooting Kerberos

 

Delegation tab is missing when carrying out delegation

The Delegation tab can be missing if you have opened the wrong account in Active Directory Users and Computers, or if the HTTP SPNs have not been configured for that account.

The delegation tab is only available after an SPN attribute has been added to the active directory object.

  1. Check that you have opened the correct account in Active Directory Users and Computers. You should open the 'SquaredUp account', i.e. the application pool identity:

    • If the SquaredUp DS application pool is configured to use NetworkService, then navigate to the computer account for the web server. For example, domain\webserver1.

    • If you have configured SquaredUp DS to use a domain service account then navigate to this domain service account. For example, domain\svc-squaredup.
      For more information see How to check and modify the application pool identity.

  2.  If the Delegation tab is still missing once you are opening the correct account in Active Directory Users and Computers then you should run the Kerberos script, to help identify the SPN problem. It is likely you will see either SPN 'HTTP/SquaredUpServer' exists but it is not registered to identity 'domain\SquaredUpAccount' or "Found duplicate SPNs" (see Troubleshooting Duplicate SPNs) and you should follow those steps to fix the SPN problem.

If the Delegation tab is shown but the MSOMSdkSvc option is missing then see SPN 'MSOMSdkSvc/SCOMServer' exists but it is not registered to identity 'domain\SCOMIdentity'

 

The MSOMSdkSvc service is not listed when carrying out delegation

The MSOMSdkSvc option is not listed if you have opened the wrong account in Active Directory Users and Computers, or if the MSOMSdkSvc SPN has not been configured correctly for the SCOM Data Access service run as account (or if using 'local service', the SCOM server computer).

  1. First, check that you have opened the correct account:

    If the SquaredUp DS application pool is configured to use NetworkService, then navigate to the computer account for the web server. For example domain\webserver1.
    If you have configured SquaredUp DS to use a domain service account then navigate to this domain service account. For example, domain\svc-squaredup. See How to check and modify the application pool identity.

  2. Secondly, when you're on the Delegation tab, check that you're adding the correct account:

    If the System Center Data Access Service is running as Local System, locate the SCOM server.
    If the System Center Data Access Service is running as a service account locate that service account. See Checking the System Center Data Access Service run as account.

  3. If the MSOMSdkSvc service is not listed for this account, then you should run the Kerberos script, to help identify the SPN problem (see Collecting diagnostic information).

    It is likely you will see either SPN 'HTTP/SquaredUpServer' exists but it is not registered to identity 'domain\SquaredUpAccount' or "Found duplicate SPNs" (see Troubleshooting Duplicate SPNs) and you should follow those steps to fix the SPN problem.

Normally the SPNs are created automatically, but if they could not be created initially or the account running the System Center Data Access Service has changed, then the SPNs need to be created now, see Configuring SPNs for SCOM.

Once the SPNs are set correctly the MSOMSdkSvc service will be listed when carrying out delegation.

 

Checking the System Center Data Access Service run as account

  1. To check the System Center Data Access Service (DAS) run as account on the SCOM server click on the Start button and type services.
  2. Locate the System Center Data Access Service and check the Log On As column to see whether the server is running as Local System or as a specific service account.

When you run the Kerberos script the System Center Data Access Service account you need is shown on the Kerberos script output:

"Determining SCOM identity for kerberos... OK ; OMSDK.Account=domain\SCOMIdentity"

Still presented with the browser logon box

If the Kerberos script does not show any errors please check the following:

  1. Restart the SquaredUp server(s).
  2. Re-run the squaredup windows command on the SquaredUp server(s). See the relevant article linked from User authentication methods for SquaredUp DS for SCOM.
  3. Configure the browsers to use Windows authentication
  4. Check Windows authentication 'Providers'
  5. Enable Kerberos event logging (see How to enable Kerberos event logging).

Re-run the squaredup windows command

Modifying the configuration causes the web application to restart and all users will be logged off.

  1. On the SquaredUp server click on the Start button and type:command prompt

  2. Navigate to the instance for which you wish to change authentication.

    For example:

    cd C:\inetpub\wwwroot\SquaredUp

    Name of the SquaredUp folder

    The default name of the SquaredUp folder is SquaredUp for v6 and above.

    For v5 it is SquaredUpv5, and for v4 SquaredUpv4.

    Location of the SquaredUp folder

    A custom location may have been chosen during the installation.

    The default location for the SquaredUp folder is C:\inetpub\wwwroot\SquaredUp

    For v5 it is C:\inetpub\wwwroot\SquaredUpv5 and for v4 C:\inetpub\wwwroot\SquaredUpv4.

  3. Run the SquaredUp command followed by windows:

    squaredup windows

    The SquaredUp command for v6 and above is SquaredUp. This is followed by an operator for the task you are carrying out, for example SquaredUp forms, SquaredUp windows, or SquaredUp ha.

    The SquaredUp command for v5 it is SquaredUp5, and for v4 SquaredUp4.

Configure the browsers to use Windows authentication

Your browser, and other users' browsers, must be configured to use automatic logon for all your SquaredUp DS URLs. The steps below describe how to configure the browser on each client (not on the server), you can test this in your own client's browser, then your organization should apply the settings to all users' browsers, perhaps using Group Policy.

Add the fully qualified domain name (FQDN) of all SquaredUp servers e.g. webserver1.domain.local (and load balanced address if using) to the list of local intranet sites, and select automatic logon, as described below. These two settings prevent the browser logon box from popping up, and allow the Windows authentication logon to be used for SquaredUp DS.

Please note that your domain settings may differ from the Internet Explorer defaults, so we recommend that you review the settings below.

    1. Navigate to Tools > Internet Options > Security > Local intranet > Sites > Advanced

    2. Enter the fully qualified domain name (FQDN) for your SquaredUp server(s), and click Add, then Close, then OK.

      When using multiple load balanced servers you must add the FQDN of each server, and also the load balanced address.

    3. Click on Local intranet and then Custom level

    4. Scroll to the bottom of the settings and verify that either of the following settings are enabled:

      Automatic logon with current user name and password

      Automatic logon only in Intranet zone

    5. Click OK, then Yes, then OK.

    6. Add the sites to the local intranet sites on ALL clients. (For example using Group Policy, see Internet Explorer prompting for credentials - Windows authentication (Clint Boessen's blog)).

By default, Chrome uses the Internet Explorer local intranet sites configuration. Follow the steps for Internet Explorer.

In addition, Chrome requires that Kerberos constrained delegation is explicitly configured.

For more details, see The Chromium Projects - HTTP authentication

Firefox requires explicit configuration to enable Windows authentication.

  1. Type about:config in the location bar.
  2. Type network.negotiate-auth.trusted-uris in the search box.

  3. Double-click on the setting returned and type the SquaredUp server name and then the fully qualified domain name (FQDN) separated by a comma and a space. Do not include the http:// or https://

    When using multiple load balanced servers you should add the FQDN of each server, and also the load balanced address.

  4. Click OK.
  5. Repeat these steps for the network.negotiate-auth.delegation-uris setting.

Check Windows authentication 'Providers'

If the SquaredUp DS Kerberos script finds all settings correct, but you are still seeing the browser login box, and entering the logon details of a SCOM user does not allow you access to SquaredUp DS, then you should check the Windows authentication 'Providers' as described below.

  1. On the SquaredUp server, open IIS, click on the SquaredUp DS application, then open Authentication from the middle pane. Right-click on Windows Authentication and select Providers.

  2. Check the list of Enabled Providers. It should show Negotiate, at the top of the list, NOTNegotiate:Kerberos. In the Providers list (under Actions on the right) ensure Negotiate is above NTLM using 'Move Up' and 'Move Down'.

  3. If Negotiate:Kerberos is listed please remove this, and add Negotiate.

  4. Click OK.

  5. Before testing, you'll need to close and reopen your browser.

How to enable Kerberos event logging

If it is proving difficult to narrow down the issue, enabling Kerberos event logging may help.

  1. Enable Kerberos event logging on the SquaredUp server, as described in the following Microsoft article, by setting the LogLevel value to 1:

    How to enable Kerberos event logging

  2. Once Kerberos logging is enabled on the SquaredUp server, go to a client and log out and in again and attempt to open SquaredUp DS.
  3. On the SquaredUp server open Event Viewer, then go to Windows logs > System, and look for any Kerberos errors.
  4. For assistance please contact SquaredUp Support and reply to the automatic response with the output of the SquaredUp DS Diagnostics and a screenshot of the Kerberos errors (see Collecting diagnostic information).

You should remove Kerberos event logging once Kerberos is configured correctly.

 

Check that delegation has been set up

We can run a PowerShell command to check how delegation has been configured.

You will need to know:

  • Whether the SquaredUp DS application pool is running as Network Service, or a domain service account (How to check and modify the application pool identity).
  • Whether the System Center Data Access Service on the SCOM server is running as local system or a service account.
  • The relevant Distinguished Name (DN). If the SquaredUp DS application pool is running as Network Service then you will need the DN for the SquaredUp server name. If it is using a domain service account you will need the DN of that user account.

We will be running the next command on a domain controller, and you can find the Distinguished Name using PowerShell on a domain controller. For Network Service use Get-ADComputer SquaredUpServer, for a domain service account useGet-ADUser SquaredUpAccount. Alternatively, you can get the DN on a non-domain controller by running the relevant SETSPN command, either SETSPN -L SquaredUpServer or SETSPN -L SquaredUpAccount.

  1. On a domain controller click on the Start button type:

    powershell

  2. Right-click on the PowerShell icon and click Run as administrator.

    Get-ADObject "CN=SquaredUpServer,OU=organizational unit,DC=domain,DC=tld" -Properties msDS-AllowedToDelegateTo

    Where CN=SquaredUpServer,OU=organizational unit,DC=domain,DC=tld is the Distinguished Name (DN)

    You should have an output similar to the following:

    DistinguishedName : CN=SquaredUpServer,OU=organizational unit,DC=domain,DC=tld msDS-AllowedToDelegateTo : {MSOMSdkSvc/SCOMServerName.domain.tld, MSOMSdkSvc/SCOMServerName} Name : SquaredUpServer ObjectClass : computer ObjectGUID : f044abee-7ea2-49c6-8704-de379fecd1d4
  3. Check the msDS-AllowedToDelegateTo line.

If the System Center Data Access Service on the SCOM server is running as local system then msDS-AllowedToDelegateTo should show the correct SCOM server.

If the System Center Data Access Service is running as a service account then msDS-AllowedToDelegateTo should show the service account.

This information maps to the Trust this user for delegation to specified services only checkbox.

 

 

Related articles

Comments

0 comments

Please sign in to leave a comment.