• Agentless DSSO
• GSS_Error

To resolve the Kerberos validation failed with result=GSS_ERROR error, follow these steps:

1. Ensure the host machine and Domain Controllers are set to the correct time. Clock Skew can cause the GSS_Error. 
2. Ensure that a dedicated Active Directory service account is being used for the SPN and that all the requirements listed in Create a service account and configure a Service Principal Name have been followed.
3. Verify that the service account is active and unlocked in Active Directory and that the password status is set to Never Expires.

4. Ensure that the casing of the service account (uppercase vs. lowercase) used in the SPN command matches what is listed in Active Directory.
5. Ensure the service account's UPN prefix and sAMAccountName match in AD. 
   NOTE: Make sure that the UPN is used and not the User log on name (pre Windows 2000). This can still generate a GSS_Error. 
6. Verify that AES Encryption is set on the account and the domain and that the box enforcing DES encryption is NOT checked.
7. Try resetting the service account password. Be sure to reset the password in Okta under Delegated Authentication as well.
8. Remove the existing SPN record.

   • To delete an existing SPN, run the following command:

     setspn -d HTTP/<myorg>.kerberos.<okta|oktapreview|okta-emea>.com <ServiceAccountName>.

     Replace <myorg> with the organization name and <okta|oktapreview|okta-emea> with the appropriate Okta URL for the instance. Replace <ServiceAccountName> with the name of the service account from which the SPN is to be deleted.

9. Re-add the SPN.

• • To configure an SPN for the service account, run the following command:

    setspn -S HTTP/<myorg>.kerberos.<okta|oktapreview|okta-emea>.com <ServiceAccountName>.

    Replace <myorg> with the organization name and <okta|oktapreview|okta-emea> with the appropriate Okta URL for the instance. Replace <ServiceAccountName> with the name of the created service account. Ensure the casing for the service account matches between AD and the SPN command.

10. If the issue persists, recreate the SPN service account, reset the credentials in Okta, and set a new SPN record on the new account. Be sure to follow all recommendations listed in Create a Service Account and configure a Service Principal Name.

NOTE: Test after each step to see if the error is resolved.

If the issue persists after performing the above steps, it is environmental and must be investigated by the org's AD team.