Resources For IT Professionals
Page Details
  • First published by (bMicrosof)
  • When: 14 Feb 2013 10:32 AM
  • Last revision by (cMV)
  • When: 29 Jul 2013 11:42 PM
  • Revisions: 5
  • Comments: 0
Options

Revision #3

Wiki  >  TechNet Articles  >  Troubleshooting FIM: Service Is Not Available - Invalid SPN on the Application Pool Identity Account  >  Revision #3
Troubleshooting FIM: Service Is Not Available - Invalid SPN on the Application Pool Identity Account
You are currently reviewing an older revision of this page.
Go to current version
PROBLEM STATEMENT
The customer is not able to view the FIM Portal via the FIM Portal Server.  We were focused on the FIM Administrator account, because that account could not reach the FIM Portal on the FIM Portal Server.   We were receiving a “Service Is Not Available” message when viewing the FIM Portal from a client machine, and nothing but a white page when viewing from the FIM Portal Server.
CAUSE
The SPN on the Application Pool Account (SharePoint – 80) is invalid.  We were able to discover this by running a network monitor trace on the FIM Portal server when attempting to access the FIM Portal. 
NETWORK MONITOR TRACE INFORMATION

1.      The Network Trace displays sever a KDC_ERR_S_PRINCIPAL_UNKNOWN. 

ErrorCode: KDC_ERR_S_PRINCIPAL_UNKNOWN (7)

This is the response to a request for HTTP/fimportal.domainCU.com

Sname: HTTP/fimportal.domainCU.com  

APPLICATION POOL ACCOUNT SPN
Registered ServicePrincipalNames for (( DN for the Application Pool Account ))
               HTTP/FIMPortal.domain.com
               HTTP/FIMPortal
               HTTP/FIMService.domain.com
               HTTP/FIMService

2.      The following SPNs are not listed here.

a.      HTTP/fimportal.domainCU.com

3.      Additionally, the following SPNs should be removed:

a.      HTTP/FIMService.domain.com

b.      HTTP/FIMService

 
RESOLUTION
To resolve the issue, we will need to update the SPN for the Application Pool Account (SharePoint-80) to contain the correct SPN information.
Registered ServicePrincipalNames for CN=AppPoolAccount,OU=myou,OU=orgou,OU=departmentou,DC=domainCU,DC=com:
HTTP/FIMPortal.domainCU.com
HTTP/FIMPortal
HTTP/PortalMachineName.domainCU.com
HTTP/PortalMachineName
 
Revert to this revision