Conexión de FME Server a Active Directory - Fallo en la creación de credenciales

Question

Estoy tratando de utilizar la integración de Active Directory de FME Server para autenticar a los usuarios. La conexión funciona pero falla poco después (y el inicio de sesión único falla).

La cuenta tiene permiso para conectarse como un servicio y la confianza entre dominios está establecida.

¿Alguna idea?

Wed-26-Nov-2014 11:38:47 AM   INFORM   main   405404 : Transformation Manager init OK
Wed-26-Nov-2014 11:38:47 AM   WARN     main   408034 : (Active Directory) Key distribution centre (KDC) was not specified in configuration; using connected server as KDC.
Wed-26-Nov-2014 11:38:47 AM   INFORM   main   408001 : (Active Directory) Connecting to an available server in ( PRODUCTION.DOMAIN:389 )...
Wed-26-Nov-2014 11:38:47 AM   INFORM   main   408002 : (Active Directory) Successfully connected to PRODUCTION.DOMAIN.
Wed-26-Nov-2014 11:38:47 AM   INFORM   main   408004 : (Active Directory) Found default naming context "DC=production,DC=domain".
Wed-26-Nov-2014 11:38:47 AM   INFORM   main   408006 : (Active Directory) Using default NT domain "PRODUCTION".
Wed-26-Nov-2014 11:38:47 AM   INFORM   main   408037 : (Active Directory) Using connected server "PRODUCTION.DOMAIN" as KDC.
Wed-26-Nov-2014 11:38:47 AM   INFORM   main   408029 : (Active Directory) Found supported SASL mechanism "GSSAPI".
Wed-26-Nov-2014 11:38:47 AM   INFORM   main   408029 : (Active Directory) Found supported SASL mechanism "GSS-SPNEGO".
Wed-26-Nov-2014 11:38:47 AM   INFORM   main   408029 : (Active Directory) Found supported SASL mechanism "EXTERNAL".
Wed-26-Nov-2014 11:38:47 AM   INFORM   main   408029 : (Active Directory) Found supported SASL mechanism "DIGEST-MD5".
Wed-26-Nov-2014 11:38:47 AM   INFORM   main   408032 : (Active Directory) Configured to use SASL mechanism "GSSAPI" for authentication.
Wed-26-Nov-2014 11:38:47 AM   INFORM   main   408039 : (Active Directory) Authenticating user "AnFMEAccount@DEVELOPMENT.DOMAIN" using SASL mechanism "GSSAPI" with KDC address "PRODUCTION.DOMAIN" and realm "PRODUCTION"...
Wed-26-Nov-2014 11:38:47 AM   INFORM   main   408060 : (Active Directory) Successfully established a new connection to PRODUCTION.DOMAIN.
Wed-26-Nov-2014 11:38:47 AM   ERROR    main   408010 : (Active Directory) Exception: "LDAPException(resultCode=82 (local error), errorMessage='The GSSAPI authentication attempt failed:  java.security.PrivilegedActionException: LDAPException(resultCode=82 (local error), errorMessage='Unable to create the initial GSSAPI SASL request:  javax.security.sasl.SaslException: GSS initiate failed [Caused by GSSException: No valid credentials provided (Mechanism level: Fail to create credential. (63) - No service creds)] caused by GSSException: No valid credentials provided (Mechanism level: Fail to create credential. (63) - No service creds) caused by KrbException: Fail to create credential. (63) - No service creds') caused by LDAPException(resultCode=82 (local error), errorMessage='Unable to create the initial GSSAPI SASL request:  javax.security.sasl.SaslException: GSS initiate failed [Caused by GSSException: No valid credentials provided (Mechanism level: Fail to create credential. (63) - No service creds)] caused by GSSException: No valid credentials provided (Mechanism level: Fail to create credential. (63) - No service creds) caused by KrbException: Fail to create credential. (63) - No service creds')LDAPException(resultCode=82 (local error), errorMessage='Unable to create the initial GSSAPI SASL request:  javax.security.sasl.SaslException: GSS initiate failed [Caused by GSSException: No valid credentials provided (Mechanism level: Fail to create credential. (63) - No service creds)] caused by GSSException: No valid credentials provided (Mechanism level: Fail to create credential. (63) - No service creds) caused by KrbException: Fail to create credential. (63) - No service creds') caused by javax.security.sasl.SaslException: GSS initiate failed [Caused by GSSException: No valid credentials provided (Mechanism level: Fail to create credential. (63) - No service creds)] caused by GSSException: No valid credentials provided (Mechanism level: Fail to create credential. (63) - No service creds) caused by KrbException: Fail to create credential. (63) - No service creds')"
Wed-26-Nov-2014 11:38:47 AM   ERROR    main   408003 : (Active Directory) Failed to connect to an available server, or no servers were available.
Wed-26-Nov-2014 11:38:47 AM   FATAL    main   405405 : Security Manager init FAILED
Wed-26-Nov-2014 11:38:47 AM   INFORM   main   405417 : Security Requests Dispatcher init OK
Wed-26-Nov-2014 11:38:47 AM   INFORM   main   405411 : Log Manager init OK
Wed-26-Nov-2014 11:38:47 AM   INFORM   main   408301 : Initializing cluster management ...
Wed-26-Nov-2014 11:38:47 AM   INFORM   main   408304 : Failover is disabled.
Wed-26-Nov-2014 11:38:47 AM   INFORM   main   000000 :

Answer 1

FME Server (LDAP - Lightweight Directory Access Protocol) distingue entre mayúsculas y minúsculas

Edición LDAPException(resultCode=82 (el error local es el fallo de nombre de usuario/contraseña debido a que se distingue entre mayúsculas y minúsculas)

Fallo de autenticación SASL 1

Síntoma

Al utilizar la autenticación SASL (Kerberos V5), se produce el siguiente error aparece en el archivo de registro:

(Active Directory) Excepción: " LDAPException(resultCode=82 (local error), errorMessage='Se ha producido un error al intentar inicializar el contexto de inicio de sesión de JAAS para la autenticación GSSAPI: javax.security.auth.login.LoginException: Pre-autenticación era inválida (24) causada por KrbException: Pre-authentication information was invalid (24) caused by KrbException: Identifier doesn't match expected value (906)')"

Causa

El nombre de usuario y/o la contraseña se han introducido incorrectamente.

Resolución

Asegúrese de que el nombre de usuario y la contraseña están correctamente introducidos. Tenga en cuenta que cuando se utiliza la autenticación SASL (Kerberos V5), el nombre de usuario es distingue entre mayúsculas y minúsculas, y debe coincidir exactamente con el valor de 'sAMAccountName' para de la cuenta.

Para obtener el nombre de la cuenta de usuario:

Desde AD Explorer, conéctese al Directorio Activo. Busque y seleccione la entrada que representa la cuenta de usuario. El nombre de la cuenta de usuario aparece en el atributo "sAMAccountName".

Fuente:

http://docs.safe.com/fme/html/FME_Server_Documentation/Default.htm#AdminGuide/Authent_Failure.htm