How To Fix SPN021 - & User Principal(s) found:

SPN021 - Overview

• Message type: E = Error

• Message class: SPN - SPnego

• Message number: 021

• Message text: & User Principal(s) found:

What causes this issue?

If the transaction has found more than one Kerberos User Principal Name
assigned to a Service Principal Name, you must make sure that there is a
unique assignment between the Service Principal Name and the Kerberos
User Principal Name in Active Directory. Every HTTP or SAP Service
Principal Name must be assigned to exactly one Kerberos User Principal.

System Response

The system issues an error message and will not allow you to continue with this transaction until the error is resolved.

How to fix this error?

Contact the administrators who are responsible for Active Directory and
ask them to make sure that the assignment between Service Principal Name
and Kerberos User Principal Name is unique.

Procedure for System Administrators

Error message extract from SAP system. Copyright SAP SE.

Smart SAP Assistant

• What is the cause and solution for SAP error message SPN021 - & User Principal(s) found: ?

  The SAP error message SPN021 typically relates to issues with the Service Principal Name (SPN) configuration in a Kerberos authentication setup. This error indicates that there are multiple user principals found for a given SPN, which can lead to ambiguity in authentication.
  
  Cause:
  
  
  Duplicate SPNs: The most common cause of the SPN021 error is the existence of multiple user accounts (principals) that are registered with the same SPN in Active Directory. This can happen if:
  
  SPNs were incorrectly registered for multiple accounts.
  There are remnants of old accounts that were not properly cleaned up.
  
  
  
  Misconfiguration: Incorrect configuration of the SAP system or Active Directory can also lead to this error. This includes issues with the way SPNs are set up or how the SAP system is trying to authenticate.
  
  
  
  Solution:
  
  
  Identify Duplicate SPNs:
  
  Use the setspn command in Windows to list all SPNs associated with a particular SPN. For example:setspn -Q <SPN>
  
  This will show you all the user