General Errors

Forgotten Passwords

If an application user forgets the password, you need to reset the password. To do this, you must have the correct administrative permissions: i for Inquire About Principals and c for Change Principal Passwords.

Using either Administrator or Command-Line-Administrator, change the password and inform the user of the new temporary password. By default, the user will be required to change the password on the next logon.

Locking and Unlocking Accounts

If a user or a service principal exceeds the maximum number of failed authentication attempts allowed by the password policy file, the account is locked and the principal will not be issued a ticket. Alternatively, a security administrator may have purposefully locked a principal account so it could temporarily not be used. In each case, the principal remains in the principal database, but is unable to use Kerberos services.

To unlock a principal account, use either the Administrator or Command-Line-Administrator.

Using the Administrator:

You must have the correct administrative permissions, i for Inquire About Principals and m for Modify Principals, to lock or unlock an account.

Using the Command-Line-Administrator:

Clock Synchronization

While client clocks are not required to be closely synchronized with the security server or application server, we recommend that you do loosely synchronize all client clocks with the server.

In the event that the client clock is outside the permitted clock skew of five minutes, you will see entries in the client systems log file that indicate the condition.

To eliminate the warnings, synchronize the client clock with the server to within five minutes.

	NOTE: You must closely synchronize all security server and application server clocks. We recommend that you implement a secured time service to ensure that all clocks are synchronized.