## 3.12.3.1  Kerberos-Related Authentication Issues
## GSS API Errors
Kerberos authentication is implemented in the SAP HANA database using the Generic Security Services Application Program Interface (GSS API). Since GSS API is an internet standard (RFC 4121), all Kerberosrelated errors are traced under the authentication trace component in the following generic way:
&lt;SAP HANA DB error text>= (&lt;GSS major code>=.&lt;GSS minor code>= - &lt;GSS major text>= &lt;GSS minor text>=)
GSS API error texts are sometimes difficult to relate to the concrete problem. The following table contains some hints for selected trace messages, refer also to the How-to document attached to SAP Note 1837331 for full details of these and other problems.
| GSS API Error Code   | Error Text                                                                                                                                | Hint                                                                                                                                                                            | Solution                                                                                                             |
|----------------------|-------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------|
| 851968.252963 9142   | Minor error text: Key version number for principal in key table is incorrect                                                              | The service key table (keytab) in use on the SAP HANAdatabase host does not match the one cre- ated on the authentication server.                                               | Re-export the keytab file from the authentication server and re-im- port it into the host's Kerberos in- stallation. |
| 851968.397560 33     | SAP HANAdatabase error text: Cannot get keytab entry for host: <FQDN> Minor error text: No principal in keytab matches desired name       | The location of the Kerberos keytab file might be incor- rect. The file is located in directory $HOME/etc (by default, that is /usr/sap/ <SID>/home/etc/ krb5_hdb.keytab).      | Check environment variable KRB5_KTNAME.                                                                              |
| 851968.252963 9136   | SAP HANAdatabase error text: Cannot get keytab entry for host: <FQDN> Minor error text: Configuration file does not specify default realm | The location of the Kerberos configuration file might be in- correct. The file is located in directory $HOME/etc (by default, that is /usr/sap/ <SID>/home/etc/ krb5_hdb.conf). | Check environment variable KRB5_CONFIG.                                                                              |
## Configuration
There are many potential problems setting up a Kerberos infrastructure that are not related to the SAP HANA system in particular, but relevant for any Kerberos-based authentication. For further information, refer to the documentation provided with MIT Kerberos or Microsoft Server/Active Directory.
## Useful SAP Notes
|   SAP Note | Description                                              |
|------------|----------------------------------------------------------|
|    1837331 | HOWTOHANADBSSOKerberos/ Active Directory                 |
|    2354473 | SSO troubleshooting for HANAand Analysis Office (SPNEGO) |
|    1813724 | HANASSO/Kerberos: create keytab and validate conf        |
|    2354556 | Commonerrors when executing hdbkrbconf.py                |
## Related Information
Single Sign-On Using Kerberos