How To Fix SPN021 - & User Principal(s) found:

SAP Error Message - Details

• Message type: E = Error

• Message class: SPN - SPnego

• Message number: 021

• Message text: & User Principal(s) found:

What causes this issue?

If the transaction has found more than one Kerberos User Principal Name
assigned to a Service Principal Name, you must make sure that there is a
unique assignment between the Service Principal Name and the Kerberos
User Principal Name in Active Directory. Every HTTP or SAP Service
Principal Name must be assigned to exactly one Kerberos User Principal.

System Response

The system issues an error message and will not allow you to continue with this transaction until the error is resolved.

How to fix this error?

Contact the administrators who are responsible for Active Directory and
ask them to make sure that the assignment between Service Principal Name
and Kerberos User Principal Name is unique.

Procedure for System Administrators

Error message extract from SAP system. Copyright SAP SE.

Smart SAP Assistant

• What is the cause and solution for SAP error message SPN021 - & User Principal(s) found: ?

  The SAP error message SPN021 typically relates to issues with the Service Principal Name (SPN) configuration in a Kerberos authentication setup. This error indicates that there are multiple user principals found for a given SPN, which can lead to ambiguity in authentication.
  Cause:
  
  
  Duplicate SPNs: The most common cause of the SPN021 error is the existence of multiple user accounts (principals) that are registered with the same SPN in Active Directory. This can happen if:
  
  SPNs were incorrectly registered for multiple accounts.
  There are remnants of old accounts that were not properly cleaned up.
  
  
  
  Misconfiguration: Incorrect configuration of the SAP system or Active Directory can also lead to this error. This includes issues with the way SPNs are set up or how the SAP system is trying to authenticate.
  
  
  Solution:
  
  
  Identify Duplicate SPNs:
  
  Use the setspn command in Windows to list all SPNs associated with a particular SPN. For example:
  setspn -Q <SPN>
  
  This will show you all the user accounts that have been registered with that SPN.
  
  
  
  Remove or Correct Duplicates:
  
  Once you identify the duplicate SPNs, you can either remove the unnecessary ones or correct the configuration. Use the following command to delete an SPN:
  setspn -D <SPN> <AccountName>
  
  Ensure that only the intended account has the SPN registered.
  
  
  
  Check SAP Configuration:
  
  Verify the SAP system's configuration for Kerberos authentication. Ensure that the correct SPNs are being used and that they match the configuration in Active Directory.
  
  
  
  Test Authentication:
  
  After making changes, test the Kerberos authentication to ensure that the error is resolved.
  
  
  
  Related Information:
  
  SPN: A Service Principal Name is a unique identifier for a service instance. It is used in Kerberos authentication to associate a service instance with a service logon account.
  Kerberos Authentication: This is a network authentication protocol designed to provide strong authentication for client/server applications through secret-key cryptography.
  Active Directory: A directory service developed by Microsoft for Windows domain networks, which is used for managing permissions and access to networked resources.
  
  Additional Tips:
  
  Always back up your Active Directory settings before making changes.
  Ensure that you have the necessary permissions to modify SPNs in Active Directory.
  Consult SAP documentation or your system administrator for specific configurations related to your SAP environment.
  
  If the problem persists after following these steps, consider reaching out to SAP support or your IT department for further assistance.