libgssapi_krb5.so - failed SEGV_ACCERR: Invalid permissions for mapped object

[Steven_181]

We are trying to setup kerberos authentication with our AD for  SAP SNC communication..

This is for a test project.

We have setup the krb2 tab file and we are able to successfully create ticket - klist.

opt/krb5core/bin/klist -e

Ticket cache: FILE:/tmp/krb5cc_109
Default principal: MCQ_SNC_SPNEGO/helloworld.corp.xxx.com@XXXX.XXX.XXX.COM

Valid starting Expires Service principal
03/04/22 22:59:23 03/05/22 08:59:23 krbtgt/XXXX.XXX.XXX.COM@XXXX.XXX.XXX.COM
Etype (skey, tkt): AES-256 CTS mode with 96-bit SHA-1 HMAC, AES-256 CTS mode with 96-bit SHA-1 HMAC

However below is the error when we start SAP?

We have spend couple of hours but still could not figure out why the HP-UX 11.31  /usr/lib/hpux64/gss/libgssapi_krb5.so is throwing out error.

Any help is appreciated..

N SncInit(): Initializing Secure Network Communication (SNC)
N HP (IA-64) with HP-UX (mt,ascii,SAP_UC/size_t/void* = 16/64/64)
N UserId="mcqadm" (109), envvar USER="<undefined>"
N SncInit(): found snc/data_protection/max=3, using 3 (Privacy Level)
N SncInit(): found snc/data_protection/min=2, using 2 (Integrity Level)
N SncInit(): found snc/data_protection/use=3, using 3 (Privacy Level)
N SncInit(): found snc/gssapi_lib=/usr/lib/hpux64/gss/libgssapi_krb5.so
N File "/usr/lib/hpux64/gss/libgssapi_krb5.so" dynamically loaded as GSS-API v2 library.
N The internal Adapter for the loaded GSS-API mechanism identifies as:
N Internal SNC-Adapter (Rev 1.0) to Kerberos 5/GSS-API v2
M si_code = 2
M Sending process ID = 60212688
M Real user ID of sending process = 323557984
M SEGV_ACCERR: Invalid permissions for mapped object
M 400000000396c5d0 (Memory location which caused fault)
M ------------------ C-STACK ----------------------
(0) 0x4000000005baf3d0 HPUXDoStack + 0x130 at /bas/749_REL/src/base/dptrc/dptstackHPUX.c:116 [dw.sapMCQ_DVEBMGS20]
(1) 0x4000000005baf1f0 CTrcStack2 + 0x80 at /bas/749_REL/src/base/dptrc/dptstack.c:191 [dw.sapMCQ_DVEBMGS20]
(2) 0x400000000b28c9d0 SigIGenAction + 0xdf0 at /bas/749_REL/src/krn/sig/sigux.c:1867 [dw.sapMCQ_DVEBMGS20]
(3) <signal handler called>
(4) 0xc000000013491a60 krb5_copy_data + 0xa0 at /uxdev/karthig/1131IA64/dce/src/security/krb5/lib/krb/copy_data.c:82 [/usr/
lib/hpux64/libdcekt.so.1]
(5) 0xc000000013492190 krb5_copy_principal + 0x160 at /uxdev/karthig/1131IA64/dce/src/security/krb5/lib/krb/copy_princ.c:84
[/usr/lib/hpux64/libdcekt.so.1]
(6) 0xc0000000003ce390 krb5_gss_duplicate_name + 0xd0 at /ux/krb/sec/src/krb/krbclnt/lib/gssapi/krb5/duplicate_name.c:48 [/
usr/lib/hpux64/gss/libgssapi_krb5.so]
(7) 0xc0000000003de6b0 gss_duplicate_name + 0x30 [/usr/lib/hpux64/gss/libgssapi_krb5.so]
0xc0000000003cd100 krb5_gss_canonicalize_name + 0x170 at /ux/krb/sec/src/krb/krbclnt/lib/gssapi/krb5/canon_name.c:40 [/
usr/lib/hpux64/gss/libgssapi_krb5.so]
(9) 0xc0000000003de5b0 gss_canonicalize_name + 0x30 at /ux/krb/sec/src/krb/krbclnt/lib/gssapi/krb5/krb5_gss_glue.c:546 [/us
r/lib/hpux64/gss/libgssapi_krb5.so]
(10) 0x400000000af5a890 SncPGSSImportName + 0x310 at /bas/749_REL/src/krn/snc/sncxxall.c:2751 [dw.sapMCQ_DVEBMGS20]
(11) 0x400000000af5ea40 SncPSetNewName + 0x200 at /bas/749_REL/src/krn/snc/sncxxall.c:2575 [dw.sapMCQ_DVEBMGS20]
(12) 0x400000000af69d30 SncInit + 0x1340 at /bas/749_REL/src/krn/snc/sncxxpar.c:720 [dw.sapMCQ_DVEBMGS20]
(13) 0x400000000af6e960 SncInitU + 0x60 at /bas/749_REL/src/krn/snc/sncxxu.c:623 [dw.sapMCQ_DVEBMGS20]
(14) 0x4000000003e57770 ThSncInit(unsigned char) + 0xd0 at /bas/749_REL/src/krn/si/th/thxxsnc.c:270 [dw.sapMCQ_DVEBMGS20]
(15) 0x400000000418dba0 [local to _INTERNAL324881180_]::ThInit() + 0x1000 at /bas/749_REL/src/krn/si/th/thxxhead.c:1355 [dw.
sapMCQ_DVEBMGS20]
(16) 0x4000000003f99660 ThStart() + 0x4f0 at /bas/749_REL/src/krn/si/th/thxxhead.c:873 [dw.sapMCQ_DVEBMGS20]
(17) 0x4000000004285120 DpMain + 0x7e0 at /bas/749_REL/src/krn/si/dp/dpInit.c:520 [dw.sapMCQ_DVEBMGS20]
(18) 0x400000000538efe0 main + 0x80 at /bas/749_REL/src/krn/sapr3/thxxanf.c:79 [dw.sapMCQ_DVEBMGS20]
(19) 0xc00000000006fbd0 main_opd_entry + 0x50 [/usr/lib/hpux64/dld.so]
M ------------------ c-stack end ------------------

[Bertram Stoeckler]

I think you should check with SAP-support.

Technically the crash is triggered while copying a principal structure. Obviously the copy tries to access a valid memory location that it has no permissions to access to. This can have mulitple reasons and the error can also be misleading and only a side-effect of a misconfiguration, or other bug.

If i google with the error-output that you provided i found the following differences:

1.  >N UserId="mcqadm" (109), envvar USER="<undefined>"

Maybe the environemnt variable "USER" need to be defined.

2. >M Real user ID of sending process = 323557984

Does this very large "Real user ID" makes any sense to you? Do you know that number from your configuration?

From what i can see in the internet, the "Real user ID" mentioned in the error-message refers to a UNIX-user-id. And that ID is indeed too large.  So just an idea... Maybe if "USER" is not defined, the user-id gets a bogus value, which then causes the access-permission problems.  

As i wrote. Next stop should be SAP-support.

Hope that helps.

[Steven_181]

Thank you very much.