Troubleshooting

Service Principal Name Does Not Match

Consider the following client error:

ERROR: p8188 t99998 c5 Retrieved client name 'user2@EXAMPLE.COM' does not match expected 'user1@EXAMPLE.COM'. Access denied
ERROR: p8188 t99998 c5 ProcessHandshakeResponsePacket() failed. Sending back 1045: Retrieved principal does not match expected Kerberos username

This error scenario is caused by attempting to connect as a SingleStore user with an SPN that differs from the SPN to which the SingleStore user is bound. For example, a SingleStore user ('user1'@'%') is bound to the user1@EXAMPLE.COM SPN. The client’s currently initialized SPN is user2@EXAMPLE.COM. If you attempt to connect to SingleStore as the 'user1'@'%' user, SingleStore will deny access because 'user1'@'%' is not bound to user2@EXAMPLE.COM. To resolve this error, retrieve a TGT using kinit for the correct user1@EXAMPLE.COM SPN and try the connection again.