# Troubleshooting

You may encounter errors during initial configuration or when attempting to connect to SingleStore as a Kerberos-authenticated user. This section describes common error scenarios and how to resolve them.

## Service Principal Name Does Not Match

Consider the following client error:

```
ERROR: p8188 t99998 c5 Retrieved client name 'user2@EXAMPLE.COM' does not match expected 'user1@EXAMPLE.COM'. Access denied
ERROR: p8188 t99998 c5 ProcessHandshakeResponsePacket() failed. Sending back 1045: Retrieved principal does not match expected Kerberos username

```

This error scenario is caused by attempting to connect as a SingleStore user with an SPN that differs from the SPN to which the SingleStore user is bound. For example, a SingleStore user (`'user1'@'%'`) is bound to the `user1@EXAMPLE.COM` SPN. The client’s currently initialized SPN is `user2@EXAMPLE.COM`. If you attempt to connect to SingleStore as the `'user1'@'%'` user, SingleStore will deny access because `'user1'@'%'` is not bound to `user2@EXAMPLE.COM`. To resolve this error, retrieve a TGT using `kinit` for the correct `user1@EXAMPLE.COM` SPN and try the connection again.

***

Modified at: October 11, 2022

Source: [/db/v9.1/security/authentication/kerberos-authentication/troubleshooting/](https://docs.singlestore.com/db/v9.1/security/authentication/kerberos-authentication/troubleshooting/)

(An index of the documentation is available at /llms.txt)