Troubleshoot

This section provides links to troubleshooting information about common problems for network authentication service, Enterprise Identity Mapping (EIM), and IBM-supplied applications that support Kerberos authentication.

1. All prerequisites have been completed.
2. Ensure that the user has a user profile on the iSeries™ and a principal on the Kerberos server. On the iSeries, verify the user exists by opening the Users and Groups in iSeries Navigator or using the WRKUSRPRF for a command line. On Windows^® systems, verify the user exists by accessing the Active Directory Users and Computers folder.
3. Check to see if the iSeries is contacting the Kerberos server by using the kinit command from Qshell Interpreter. If the kinit command fails, check to see if the i5/OS™ service principal has been registered on the Kerberos server. If it has not, you can add the i5/OS principal to the Kerberos server.

For information about specific troubleshooting techniques, see the following topics:

• Network authentication service errors and recovery
  You may encounter these messages during the network authentication service wizard or when you are managing network authentication service properties in iSeries Navigator.
• Application connection problems and recovery
  You may encounter these messages when applications use network authentication service.
• API trace tool
  You can set up the API trace tool to troubleshoot problems with Kerberos and Generic Security Services API calls.
• Troubleshoot Kerberos server in i5/OS PASE
  Troubleshoot Kerberos server in i5/OS PASE by accessing status and informational log files.