You may encounter errors during initial configuration or when attempting to connect to SingleStore DB as a Kerberos-authenticated user. This section describes common error scenarios and how to resolve them.

Service Principal Name Does Not Match

Consider the following client error:

ERROR: p8188 t99998 c5 Retrieved client name 'user2@EXAMPLE.COM' does not match expected 'user1@EXAMPLE.COM'. Access denied
ERROR: p8188 t99998 c5 ProcessHandshakeResponsePacket() failed. Sending back 1045: Retrieved principal does not match expected Kerberos username

This error scenario is caused by attempting to connect as a SingleStore DB user with a SPN that differs from the SPN to which the SingleStore DB user is bound. For example, a SingleStore DB user ('user1'@'%') is bound to the user1@EXAMPLE.COM SPN. The client’s currently initialized SPN is user2@EXAMPLE.COM. If you attempt to connect to SingleStore DB as the 'user1'@'%' user, SingleStore DB will deny access because 'user1'@'%' is not bound to user2@EXAMPLE.COM. To resolve this error, retrieve a TGT using kinit for the correct user1@EXAMPLE.COM SPN and try the connection again.