KB - Look for Kerberos log messages

Affects product

  • Airlock Gateway

Question or problem

To investigate into Kerberos issues, start with the log messages described below.

Procedure-related prerequisites

  • You must be logged in as an admin in the Airlock Gateway Configuration Center.

Instruction

Test preparation on Airlock Gateway:

  1. Go to:
    Application Firewall >> Reverse Proxy.
  2. Edit the mapping of the Web application.
  3. Set the Operational mode to Integration.
  4. Click the Activate button.
  5. The configuration has been updated successfully.

Test preparation - reproduce the issue:

  1. After changing the Operational mode in Airlock Gateway to Integration, try to reproduce the issue.
  2. The issue could be reproduced.

Test execution and verification:

  1. Go to:
    Log & Report >> Log Viewer.
  2. Click the ⁝ button, then Open session.
  3. Select the saved search Logs - All Airlock Logs.
  4. Enter the following search string into the KQL query field:
  5. log_id:(WR-SG-SUMMARY or WR-SG-REJECT* or WR-SG-CAPI* or WR-SG-KERB*)
  6. Start the investigation with this search string.
  7. Verify the following:
    • All WR-SG-SUMMARY log messages have either rejected or blocked as the action.
    • No log messages with IDs starting with any of the following indicate a Kerberos problem:
      • WR-SG-REJECT
      • WR-SG-KERB
      • WR-SG-CAPI
  9. The logs do not indicate a Kerberos-related cause for the rejected or blocked requests.