How to troubleshoot SAP SSO/SNC keytab authentication issues (4384038)

SAP SSO may stop working after a service account password change, SAP keytab regeneration, operating system maintenance, or other Kerberos-related changes.
In this type of scenario, the SAP keytab may appear to be valid from the operating system side, but SAP SSO can still fail if the SAP SNC configuration does not match the Kerberos principal stored in the keytab.

The SAP keytab, Kerberos service account principal, and SAP SNC snc/identity/as parameter were not aligned.
For example, the keytab may contain both a service account principal and an SPN-style principal:

sap.keytab:

Vno  Type                     Principal                       Aliases
  2  aes128-cts-hmac-sha1-96  linux2-sap@BTCLD.LAB
  2  aes128-cts-hmac-sha1-96  sap/linux2.btcld.lab@BTCLD.LAB
  2  aes256-cts-hmac-sha1-96  linux2-sap@BTCLD.LAB
  2  aes256-cts-hmac-sha1-96  sap/linux2.btcld.lab@BTCLD.LAB
  2  arcfour-hmac-md5         linux2-sap@BTCLD.LAB
  2  arcfour-hmac-md5         sap/linux2.btcld.lab@BTCLD.LAB

If the SAP SNC profile is configured to use a principal that is not present in the keytab, SAP SSO may fail.
Example mismatch:
snc/identity/as = p:wrong-principal@BTCLD.LAB

while the keytab contains:

linux2-sap@BTCLD.LAB
sap/linux2.btcld.lab@BTCLD.LAB

Verify the principal stored in the SAP keytab:

/opt/quest/bin/vastool ktutil -k /etc/opt/quest/vas/sap.keytab list

Confirm that the SAP SNC snc/identity/as parameter matches a Kerberos principal present in the keytab.
For example, if the keytab contains:

sap/linux2.btcld.lab@BTCLD.LAB

then the SAP SNC configuration should be aligned with that principal:

snc/identity/as = p:sap/linux2.btcld.lab@BTCLD.LAB

If the keytab is created using the SAS service account workflow, it can be validated with vastool auth.

Example workflow:

vastool -u sysadm service create sap/linux2
cd /etc/opt/quest/vas/
vastool ktutil -k sap.keytab list
vastool -u linux2-sap@BTCLD.LAB -k /etc/opt/quest/vas/sap.keytab auth

Expected successful result:

linux2-sap@BTCLD.LAB was successfully authenticated to BT-SAS-C1$@BTCLD.LAB.

The authentication should complete successfully without prompting for the service account password.

In the investigated scenario, the issue was resolved after updating the SAP SNC snc/identity/as parameter to match the Kerberos principal stored in the SAP keytab. The mismatch prevented SAP SNC from acquiring acceptor credentials, which caused the SAP work processes to terminate during SncPAcquireCred(). After the SAP SNC configuration was corrected, SSO login worked successfully.

Whole command example outputs:
[root@bt-sas-c1 ~]# vastool -u sysadm service create sap/linux2
Password for sysadm@BTCLD.LAB:
Service sap/linux2 created successfully, keytab located at /etc/opt/quest/vas/sap.keytab.
[root@bt-sas-c1 ~]# cd /etc/opt/quest/vas/
[root@bt-sas-c1 vas]# vastool ktutil -k sap.keytab list
sap.keytab:

Vno  Type                     Principal                       Aliases
  2  aes128-cts-hmac-sha1-96  linux2-sap@BTCLD.LAB
  2  aes128-cts-hmac-sha1-96  sap/linux2.btcld.lab@BTCLD.LAB
  2  aes256-cts-hmac-sha1-96  linux2-sap@BTCLD.LAB
  2  aes256-cts-hmac-sha1-96  sap/linux2.btcld.lab@BTCLD.LAB
  2  arcfour-hmac-md5         linux2-sap@BTCLD.LAB
  2  arcfour-hmac-md5         sap/linux2.btcld.lab@BTCLD.LAB
[root@bt-sas-c1 vas]# vastool -u linux2-sap@BTCLD.LAB -k /etc/opt/quest/vas/sap.keytab auth
linux2-sap@BTCLD.LAB was successfully authenticated to BT-SAS-C1$@BTCLD.LAB.