Kerberos Authentication Notification Messages - Canon 08011-41-UD2-003 Installation And Configuration Manual

6.2.2

Kerberos Authentication Notification Messages

This section explains the Kerberos authentication notification messages, along with
possible causes and remedies.
Message
Kerberos requires
username, password,
host and domain
Kerberos bind failed, no
connection to (host)
Kerberos bind failed,
ldap ticket to (hostname)
Kerberos bind failed to
host (host) hostname
(hostname)
Unable to get LDAP
ticket to (hostname)
Clock skew exceeds
maximum tolerance at
host (host)
Unable to connect to
KDC at host (host)
Unable to connect to
KDC at domain
(domain)
Authorized Send Installation and Configuration Guide for imageRUNNER Machines
Cause
The entered user name or password
is blank, or the Configuration
servlet host or domain value is
blank.
A Kerberos bind is attempted, and
an LDAP connection has not been
established.
A Kerberos session could not be
established.
A Kerberos bind is unsuccessful to
the specified host and host name.
An LDAP ticket to the host name
could not be acquired.
Kerberos Error Code:
KDC_S_PRINCIPAL_UNKNOWN
The MEAP device clock and KDC
server clock are not within the
server's specified maximum clock
skew tolerance. The default setting
for the Windows 2000, Windows
2003, and Windows 2008 servers is
'5' minutes.
Kerberos Error Code:
AP_ERR_SKEW
A connection to the KDC at the
specified host cannot be reached.
Kerberos Error Code:
UNABLE_TO_CONNECT_KDC
Insufficient cross realm privileges
are configured for the MEAP
device's domain.
Kerberos Error Code:
KDC_WRONG_REALM
Remedy
Verify and reconfigure the
authentication server settings
for the appropriate
authentication server in the
Configuration servlet, and try
to log on again.
Check your Kerberos
configuration.
• Check your Kerberos
configuration.
• Ensure that the configured
server's host name is
correct.
Check your Kerberos
configuration.
• Check your Kerberos
configuration.
• Ensure that the configured
server's host name is
correct.
Verify that the MEAP device
clock and configured server's
clock are in sync within the
server's maximum clock skew
tolerance.
For more information, see
"Synchronizing the Device and
Server Time," on p. 142.
• Check your Kerberos
configuration.
• Ensure that the configured
server is active.
• Check your Kerberos
configuration.
• Verify the Kerberos
cross-realm configuration.
165