Skip to content

Commit

Permalink
[misc] update kerberos documentation
Browse files Browse the repository at this point in the history
  • Loading branch information
rusher authored Sep 27, 2017
1 parent 05b78b2 commit 9708fcd
Showing 1 changed file with 5 additions and 0 deletions.
5 changes: 5 additions & 0 deletions documentation/plugin/GSSAPI.creole
Original file line number Diff line number Diff line change
Expand Up @@ -113,15 +113,20 @@ Dependencies :
==Possible errors

* "GSSException: Failure unspecified at GSS-API level (Mechanism level: No Kerberos credentials available)"
There is no active credential. Check with klist that there is an existing credential. If not create it with the "kinit" command
* "java.sql.SQLInvalidAuthorizationSpecException: Could not connect: GSSAPI name mismatch, requested '[email protected]', actual name '[email protected]'"
There is an existing credential, but doesn't correspond to the connection user.
example :
if user is created with a command like
```script
CREATE USER userOne@'%' IDENTIFIED WITH gssapi AS '[email protected]';
```
klist must show the same principal ([email protected] in this example)
* "GSSException: No valid credentials provided (Mechanism level: Clock skew too great (37))". The Kerberos protocol requires the time of the client
and server to match: if the system clocks of the client does not match that of the KDC server, authentication will fail with this kind of error.
The simplest way to synchronize the system clocks is to use a Network Time Protocol (NTP) server.

0 comments on commit 9708fcd

Please sign in to comment.