Nick Wells wrote:
SPnego has been configured, and it works great about 99% of the time. By "working great", I mean when the end user accesses our "ICWEB" URL they get in without the need for their SAP CRM password.
Our URL is something like http://SAPwebDispatcher.ourdomain.com:PORT/sap/crm_logon
99% of the time, ....
but the other 1% of the time, the end-users are prompted still for credentials.
When this happens, the only work around that "works" is to go up to the top of the IE window, where you see the "Logon" tab for ICWEB:
Just to the left of "Logon" is the little circular arrow thingee:
And if the users click on that one or two times, we do get past the login screen and am able to get into ICWEB.
This has been very strange. I've seen it before on my PC and a few others have reported it. But it is rare so much that I wouldn't begin to think to open an incident since this cannot be consistently reproduced.
Please check if a cookie "sap-ssolist" was set. That cookie is set when a logon attempt with a particular credential (e.g. a SAP logon ticket or X.509 client certificate) was attempted but did fail; with subsequent http requests that particular credential will then be ignored - which could explain the observed behaviour (that a simple page refresh "heals" the logon issue).
If the problem only occurs very seldom (< 1%) tracing might be not appropriate.
But you could at least activate the Security Audit Logging in order to observe failed logon attempts (see note 495911), in order to determine patterns. This might help you to reproduce the problem - and then you can use tracing to get a deeper insight. Once you have reached that point (tracing - on the server side and potentially also on the client side using tools like HttpWatch or Fiddler), the root cause normally becomes very evident.
Kind regards,
Wolfgang