TIBCO Spotfire Server: Kerberos : KDC cannot accomodate requested option (13)

Please refer to this articles parent page for more information.

Description

This error can occur if delegation is not enabled on the service account used for Kerberos.
This is not a fatal error (i.e prevents log in to the Spotfire server)

Resolution

On a domain controller, start the Active Directory Users and Groups applet and make sure the delegation is enabled on the service account used for Spotfire server.

Please see here to learn how to enable delegation.

To confirm this, from a users workstation check the user ticket with klist as shown below. Look at the ticket that corresponds to a spotfire login. The ok_as_delegate flag will not be present.

#2> Client: spotadm @ MYDOMAIN.COM
Server: HTTP/spotfire.example.com @ MYDOMAIN.COM
KerbTicket Encryption Type: RSADSI RC4-HMAC(NT)
Ticket Flags 0x40840000 -> forwardable renewable ok_as_delegate
Start Time: 11/22/2018 13:36:49 (local)
End Time: 11/22/2018 23:36:40 (local)
Renew Time: 11/29/2018 13:36:40 (local)
Session Key Type: RSADSI RC4-HMAC(NT)