TIBCO Spotfire Server: Kerberos: Identifier doesn't match expected value.

Please refer to this articles parent page for more information.

Description

The full error for this message is as follows:

Exception: krb_error 68 null (68) null
KrbException: null (68)
at sun.security.krb5.KrbAsRep.<init>(KrbAsRep.java:76)
at sun.security.krb5.KrbAsReqBuilder.send(KrbAsReqBuilder.java:316)
at sun.security.krb5.KrbAsReqBuilder.action(KrbAsReqBuilder.java:361)
at sun.security.krb5.internal.tools.Kinit.<init>(Kinit.java:219)
at sun.security.krb5.internal.tools.Kinit.main(Kinit.java:113)
Caused by: KrbException: Identifier doesn't match expected value (906)
at sun.security.krb5.internal.KDCRep.init(KDCRep.java:140)
at sun.security.krb5.internal.ASRep.init(ASRep.java:64)
at sun.security.krb5.internal.ASRep.<init>(ASRep.java:59)
at sun.security.krb5.KrbAsRep.<init>(KrbAsRep.java:60)

Resolution

One possible cause for this error is that there was attempt to obtian a TGT with a principal name that is outside of the domain controllers realm.

The principal name in the Spotfire configuration or on command line (via) will match that in the keytab, but the domain controller won't recognise the realm.

Check for possible typos in the Kerberos configuration.

Note that each realm must be separately declared in the krb5.conf file and multiple kdc lines are allowed if more another DC is authoritative for the additional realm(s)