> Source: [sk127772](https://support.checkpoint.com/results/sk/sk127772)

# sk127772 - "principal XXX not found" error on Transparent Kerberos Authentication failure

| Property | Value |
|----------|-------|
| Solution ID | sk127772 |
| Date Created | 2018-05-30 |
| Last Modified | 2018-12-19 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |
| OS | Gaia |

## Symptoms

- * Transparent Kerberos Authentication failed, and the user is redirected to captive portal.

* From pdp debug ` (" pdp debug set all all ") ` during policy installation:  

  `KerberosAuth::AcquireServerCreds ..... Credentials acquired for service HTTP/captive.portal.name@DOMAIN.NAME`  

* From pdp debug during access authentication:  
  `[AUTH (TD::Events)] pdp::AuthMngr::DoAuthAsync: AuthMngr::Do Authentication Async function is called`  
  `
  [AUTH (TD::Events)] pdp::AuthMngr::CreateID: Created ID is: 410113747`  
  `
  [AUTH (TD::Events)] pdp::AuthMngr::IsAuthMethodSupported: IsAuthMethodSupported function is called`  
  `
  [AUTH (TD::Events)] pdp::AuthMngr::IsAuthMethodSupported: Is user kerberos auth supported?`  
  `
  [AUTH (TD::Events)] pdp::AuthMngr::IsAuthenticationAllowed: Authentication using method 2 is allowed.`  
  `
  [AUTH (TD::Events)] pdp::RequestAuthData::RequestAuthData: RequestAuthData constructor is called, reqconfirm: , basic sessionId: ee7eaaa4, super sessionId: 98944066`  
  `
  [CAPTIVE_PORTAL (TD::Important)] capor::CCaporLoginKerb::execute: error code: eRETURN_ASYNC`  
  `
  [CAPTIVE_PORTAL (TD::Events)] capor::CCaporLoginKerb::execute: waiting for async reply..request id: 410113747`  
  `
  gsasync_serve_cb: returning 999`  
  `
  [AUTH (TD::Events)] pdp::AuthMngr::StartAuthAsync: AuthMngr::StartAuthAsync function is called`  
  `
  AUTH (TD::Events)] pdp::AuthMngr::GetAuthenticator: GetAuthenticator function is called`  
  `
  [AUTH (TD::Events)] pdp::AuthMngr::GetAuthenticator: Get Kerberos Authenticator.`  
  `
  [AUTH (TD::Events)] pdp::KerberosAuthenticator::DoAuth: Entering KerberosAuthenticator::DoAuth function`  
  `
  [AUTH (TD::Events)] pdp::KerberosAuthenticator::DoAuth: will try kerberos auth with principal: HTTP/CAPTIVE.portal.name@DOMAIN.NAME and auth type: 1`  
  `
  KERBEROS_SERVER(KerberosLogger_Important)] virtual bool KerberosAuth::DoAuthentication(bool&, bool&, std::string&, std::string&, const IKerberosMessage&, IKerberosMessage&, int&, std::string&) const: `**principal HTTP/CAPTIVE.portal.name@DOMAIN.NAME not found.**   
  `
  [AUTH (TD::Important)] pdp::KerberosAuthenticator::DoAuth: DoAuthentication procedure has failed`

## Cause

The credential the client asked for is mixed case, and the credential the Security Gateway acquired is all lowercase.

For Transparent Captive portal, the keyfile on the PDP will be created using the hostname of transparent captive portal as configured in SmartConsole, but converted to all lowercase. Requested from the client as seen in [sk104055](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk104055) should show the SPN's hostname portion also in lowercase, otherwise it will fail.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content