Step 1: Verify the Kerberos configuration in Applications Manager

Ensure that Kerberos authentication has been configured correctly in Applications Manager by following the steps in the relevant KB article.

Step 2: Verify the hostname and domain configuration

Verify that the SQL Server hostname is specified using its Fully Qualified Domain Name (FQDN).

For example: mssql-kerberos-dc1.mssqlkerberos.com

Ensure that:

• The SQL Server hostname is configured using its FQDN.

• The FQDN can be resolved by the DNS server.

Run the following command:

nslookup <SQL_Server_FQDN>

Example:

nslookup mssql-kerberos-dc1.mssqlkerberos.com

Step 3: Verify the Service Principal Name (SPN) configuration

Run the following command on the SQL Server machine to verify the SPN configuration:

setspn -T <Domain_Name> -F -Q MSSQLSvc/<SQL_Server_FQDN>*

Replace:

• <Domain_Name> - with your Active Directory domain.

• <SQL_Server_FQDN> - with the SQL Server's fully qualified domain name.

Verify that the expected SPN exists and is registered correctly.

Step 4: Verify the krb5.ini configuration

Ensure that the correct krb5.ini file is being used.

Download the appropriate file based on your environment:

• Single-domain environment: krb5_file_for_single_domain_environment.zip

• Cross-domain environment: krb5_file_for_cross_domain_environment.zip

After downloading:

• Replace XXX with your domain name in uppercase.

• Set both kdc and admin_server to the FQDN of the Active Directory domain controller.

Step 5: Verify system clock synchronization

Kerberos authentication requires synchronized system clocks.

Ensure that the clocks on the following systems are synchronized:

• Domain Controller

• SQL Server

• Applications Manager server

By default, Kerberos allows a maximum clock skew of 5 minutes.

Step 6: Verify the Kerberos ticket cache (if applicable)

If ticket cache authentication is being used, verify that the Kerberos ticket is valid.

Navigate to:

<APM_HOME>/working/jre/bin

Run:

klist -l <username>@<DOMAIN>

Example:

klist -l Administrator@APMKERBEROS.COM

Confirm that a valid Kerberos ticket is available and has not expired.

Step 7: Verify common Kerberos errors

If you encounter any of the following errors:

GSS Failed: No valid credentials provided (Mechanism level: Attempt to obtain new INITIATE credentials failed!)

I/O Error: GSS Failed: Invalid name provided (Mechanism level: KrbException: Cannot locate default realm)

I/O Error: GSS Failed: No valid credentials provided (Mechanism level: Fail to create credential (63) - No service creds)

Verify the following:

• A valid Kerberos ticket exists (klist).

• The SQL Server SPN is configured correctly.

• The krb5.ini file contains the correct REALM, KDC, and admin_server entries.

• DNS resolution is functioning correctly.

• The SQL Server hostname is specified using its FQDN.

Step 8: Collect diagnostic information if the issue persists

Enable Kerberos debug logging

Add the following entry to:

<APM_HOME>/working/conf/wrapper.conf

wrapper.java.additional.33=-Dsun.security.krb5.debug=true

Restart Applications Manager.

Reproduce the issue by attempting to add the SQL Server monitor using Kerberos authentication.

Share the following information

• Screenshot showing the Kerberos configuration in Applications Manager

• Output of the setspn command

• Output of the nslookup command

• Output of the klist command

• Confirmation that the system clocks are synchronized

• Screenshot showing the debug entry added to wrapper.conf

Collect the following files from Applications Manager

Refer to our feature page to learn more about SQL Server monitoring in Applications Manager.