🟠 High   ⏱ 5–30 min  Last verified: 20 May 2026
Affected versions: IBM AIX 7.1

📖 ~1 min read

Table of contents
  1. Symptom & Impact
  2. Environment & Reproduction
  3. Root Cause Analysis
  4. Quick Triage
  5. Step-by-Step Diagnosis
  6. Solution – Primary Fix
  7. Solution – Alternative Approaches
  8. Verification & Acceptance Criteria
  9. Rollback Plan
  10. Prevention & Hardening
  11. Related Errors & Cross-Refs
  12. References & Further Reading

Symptom & Impact

Integrated login fails with `Ticket expired` and `kinit` prompts during scheduled jobs.

Environment & Reproduction

AIX 7.2 host using IBM NAS (Kerberos) integrated with AD via `KRB5LDAP` load module.

Root Cause Analysis

Service principal keytab is out of date or clock skew exceeds the 5-minute Kerberos window.

Quick Triage

Run `klist -k /etc/krb5/krb5.keytab` and `date -u` on AIX and DC to check skew.

Step-by-Step Diagnosis

Capture `/etc/krb5/krb5.conf` and test with `kinit -k host/@REALM`.

Illustrative mockup for aix-7.1 — kerberos_ticket-expired_terminal
Terminal diagnostics for Kerberos ticket expiry breaks AIX integrated login on IBM AIX 7.2 — Illustrative mockup — Progressive Robot

Solution – Primary Fix

Refresh keytab: `ktutil` or `mkkrb5clnt -c -r -s -d -A -i files`.

Still having issues? Our IT Solutions & Services team can diagnose and resolve this for you. Get in touch for a free consultation.

Illustrative mockup for aix-7.1 — kerberos_ticket-expired_logs
Logs and evidence for Kerberos ticket expiry breaks AIX integrated login on IBM AIX 7.2 — Illustrative mockup — Progressive Robot

Solution – Alternative Approaches

Re-register the host SPN in AD: `setspn -S host/ `.

Verification & Acceptance Criteria

`kinit user@REALM` succeeds and `lsuser -R KRB5LDAP ` resolves cleanly.

Rollback Plan

Switch the load module back to `LDAP` only in `/usr/lib/security/methods.cfg`.

Prevention & Hardening

Sync time with `chrony`/`xntpd`, monitor keytab age, and rotate well before kvno expires.

Pairs with `SECURITY_KRB5` errpt entries and PAM stack `pam_krb5` failures.

Related tutorial: View the step-by-step tutorial for aix-7.1.

View all aix-7.1 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

IBM Docs: IBM NAS Kerberos client, `mkkrb5clnt`, AD integration.

Need Expert Help?

If you cannot resolve this yourself, our team offers hands-on Server Management, Managed IT Services, and flexible Support Plans. Contact us today — we respond within one business day.