| Rev # | Date | Description |
|---|---|---|
| 1.0 | Mar 2020 | Added information about single sign on. Updated URLs and screen captures. Revised for use by customers and reset as document version 1.0 |
| 1.1 | Apr 2023 | Validated for version 2023 SP1. Updated screen captures and added new user and group features in the PDM administration tool. |
Note
All SolidPractices are written as guidelines. You are recommended to use these documents only after properly evaluating your requirements. Distribution of this document is limited to Dassault Systèmes SolidWorks employees, VARs and customers that are on active subscription. This document may not be posted on blogs or any internal or external forums without prior written authorization from Dassault Systèmes SolidWorks Corporation.
This document was updated using version SOLIDWORKS PDM 2023 SP1. If you have questions or need assistance in understanding the content, please get in touch with your designated reseller.
Preface:
This SolidPractice document provides information about how and when the SOLIDWORKS® PDM software authenticates against a Microsoft® Active Directory® (AD) domain controller (DC), and when the archive server sends these Kerberos V5 authentication requests to the DC. The document focuses on the SOLIDWORKS PDM Professional software version 2020, however it applies in general to both older and newer versions.
It is best to use this document in combination with instructions you find in the existing installation and administration guides for the SOLIDWORKS PDM and SOLIDWORKS PDM Professional software and with other SolidPractice guides and Knowledge Base solutions.
The administration guides are available in the SOLIDWORKS PDM installation directory under ‘\Program Files\SOLIDWORKS Corp\SOLIDWORKS PDM\Lang’ or from the SOLIDWORKS Support website at:
http://www.SOLIDWORKS.com/sw/support/Administration_guides/ServicePacks.html
This SolidPractices document references additional SolidPractices guides that you can find in the VAR Resource Center (VRC) website at:
https://www.SOLIDWORKS.com/vrc/Services/bestpractices.htm
.
Your Feedback Requested
We would like to hear your feedback and also suggestions for new topics. After reviewing this document, please take a few minutes to fill out a brief survey. Your feedback will help us create the content that directly addresses your challenges.
Introduction
The Active Directory single sign-on user authentication uses the Kerberos authentication protocol to verify the identity of any user who tries to log in to a domain or access the SOLIDWORKS PDM software using a Windows® user account with rights for the relevant vault. There is currently no support for common access card and client certificate-based authentication methods.
A key feature of Windows user authentication is the Windows Integrated Single Sign-On capability. This means that after logging in to the relevant vault, a user does not need to provide credentials more than once for the same vault during the same session. This is true unless the SOLIDWORKS PDM Automatic Login option is active. In that case, the user does not need to enter any credentials because the current Windows session login provides the authentication.
Windows assigns AD user rights (such as logon rights) to groups or users. Windows creates an access token each time a user logs in. The access token is a representation of the user account and contains the following elements:
Individual SID. A Unique Security Identifier (SID) number that represents the logged-in user, group, or computer.
Group SID. An SID that represents the logged in user's group memberships.
A user's individual SID always attaches to the user's access token. When a user becomes a member of a group, the SID for that group also attaches to the user's access token.
Network Authentication
Network authentication is the second part of the single sign-on process that confirms the identity of any user who attempts to access a SOLIDWORKS PDM vault.
Kerberos is the default method of network authentication within Windows domains. Kerberos most commonly uses a password, and apart from the user entering a password, the process happens automatically in the background without user involvement.
The Kerberos protocol verifies the identity of users. This takes place between a client computer and an authenticating server. Both the server and client computer identity each other.
The Kerberos authentication mechanism issues tickets for accessing network services. A ticket, issued by a domain controller, is a set of identification data for authenticating a security principle. Tickets contain an encrypted password that confirms the user's identity to the requested service.
The following diagram shows depicts the occurrence of a Kerberos ticket exchange between a client computer and the authenticating server:
For more information about the Kerberos authentication protocol, see the Microsoft topic at:
Determine Authenticating Servers
It can be useful to identify the current server to which your computer connects for authentication to ensure that you are authenticating through a server on the LAN (local area network) where possible. Ideally, it is best not to connect over the WAN (wide area network) to an alternative server miles away, or to a server in a different geographic region. This can have a negative performance impact on authentication response times. In addition, if the WAN goes down (for example issues with an internet connection or firewall), then authentication can still happen for the local users when authentication is local. Having additional authentication servers on both the WAN and the LAN improves redundancy.
From a troubleshooting perspective, knowing the authentication server to which you are connected is important to isolate this particular server in any authentication testing and analysis. This helps to more easily identify the IP address and host name of the relevant server when filtering test result data.
You can use the following commands to help identify the currently connected login server for authentication. Follow these steps:
Open a Windows command prompt.
Type: ipconfig /all
Locate the DNS Servers line. The IP addresses of your preferred DNS servers appears on the right. The IP address at the top of this list is the primary DNS server connection. If the primary server is unavailable (due to maintenance or other reasons), then Windows uses the secondary server.
Alternatively:
Open a Windows command prompt.
Type the following command and then press Enter:
Echo %logonserver%
Testing Tools for Analyzing Authentication Traffic
You can use an analysis tool such as Microsoft Message Analyzer or Wireshark® to record incoming and outgoing network traffic on a computer.
It is often useful to understand how long it takes for a response to a request between a client computer and a server by finding the elapsed time between requests and responses (that is, the response times). This helps you measure how well a client computer or server is keeping up and helps locate performance issues. If the response times are severely inconsistent or are longer than expected, this could indicate an issue and in turn cause delays when logging in to SOLIDWORKS PDM.
You can use the Time Delta property in Microsoft Network Monitor to filter on the difference in time. This value represents the time from the last physical frame in the network data trace.
Reduce the possibility of caching data
To reduce the possibility of caching network data (which can show old traffic data in test results), the recommendation it to use the following steps to perform a network traffic capture:
Close all non-essential applications.
Start the Network Monitor capture.
Clear the DNS cache using: ipconfig /flushdns
Clear the NetBIOS cache using: nbtstat –RR
Clear user Kerberos tickets using: klist purge
Clear system and computer Kerberos tickets using (Windows Vista or later only): Klist –li 0x3e7 purge
Initiate authentication in SOLIDWORKS PDM or SOLIDWORKS.
Stop the network monitor capture and review the results.
Add the Time Delta column in Network Monitor
Follow these steps to add the Time Delta column to the frame summary in Network Monitor.
In the Frame Summary pane, right-click the table header row and then click Choose Columns.
In the Disabled Columns list, select Time Delta and then click Add to move the column to the Enabled Columns list.
Click OK.
After capturing the network traffic, you can filter the results by authentication traffic such as Kerberos. The following image shows use of Network Monitor.
SOLIDWORKS PDM needs to authenticate only when certain events trigger this requirement. These events are as follows.
Opening the local archive view within Windows File Explorer.
Adding a new user in the SOLIDWORKS PDM Administration tool either by right-clicking Users > New user > New user, entering the Active Directory user credentials, and then clicking OK.
Or, by right clicking Users > New user > New user, clicking List Users, selecting users to add, and then clicking OK.
Validate logins in the SOLIDWORKS PDM Administration tool either by right-clicking Users > Validate Logins.
Importing user’s from Active Directory into a group within the SOLIDWORKS PDM Administration tool by right-clicking Groups > Import from Active Directory. An AD query occurs after finding and adding the relevant group at this stage. For more information, see the “Importing Active Directory Users into Groups” section of the SOLIDWORKS PDM Administration Guide (Help > Administration Guide.)
Validate groups from Active Directory within the SOLIDWORKS PDM Administration tool by right-clicking Groups > Validate Groups from Active Directory. An AD query occurs after finding and adding the relevant group at this stage. For more information, see the “Validating Groups from the Active Directory” section of the SOLIDWORKS PDM Administration Guide (Help > Administration Guide.)
For example, if a user first opens a file from “VaultA” in SOLIDWORKS, this triggers authentication. If the user subsequently browses to “VaultA” from Windows File Explorer, they do not need to authenticate again, as long as they have not logged out of the vault (using the SOLIDWORKS PDM icon in the taskbar) or restarted the computer.
Common tasks such as checking in or checking out files do not require additional authentication.
Authentication Testing Analysis
This following Network Monitor data capture records the authentication process on a local (LAN) domain controller. The capture includes10 tests for each PDM area of authentication. The horizontal line separates each separate authentication operation test and the start of a new set of network frame capture results.
Each authentication capture operation shows the set pairs of communications between the client computer and the server.
Notes:
In the Source and Destination fields with a value of Client or Server are normally the relevant IP addresses or DNS host names. These descriptions are amended for clarity. The time delta is in milliseconds. The capture includes the following errors:
KDC_ERR_PREAUTH_REQUIRED
This means that the client computer requested a ticket but did not include the pre-authentication data. Windows uses this technique to determine the supported encryption types and does not indicate a problem. Afterward, you will often see the same request sent again. However, this time the request includes the data and the domain controller issuing the ticket.KDC_ERR_S_PRINCIPAL_UNKNOWN
This means that the client computer sent a ticket request for a specific Server Principal Name (SPN) and could not locate an AD object with that SPN definition.This error commonly occurs because the SPN is not registered to any principal. You may want to investigate this further by identifying which principal will decrypt the ticket, and register the SPN to that account. However, sometimes the issue can occur because the SPN is registering with more than one principal in the same AD domain. In this case, the domain controller cannot determine which principal to use.
sPNMappings
If you want to see the default Host to SPN mappings, use either ADSI Edit or the Ldp tool to navigate to:
cn=Directory Services,CN=Windows NT,CN=Services,CN=Configuration,DC=[Your Domain Component]
Review the sPNMappings attribute.
These tests ran in a test environment without configuring delegation on the archive server.
In a production environment, if you intend to import Active Directory users into groups, and plan to use the SOLIDWORKS PDM Administration tool on a computer other than the archive server computer, you need to do the following:
Use the Active Directory Users and Computers console to configure delegation on the archive server by activating the option ‘Trust this computer for delegation to any service (Kerberos only)’..
For more information, see the section “Configuring the Active Directory Domain Controller” in the SOLIDWORKS PDM administrative guide.
Logging in to SOLIDWORKS PDM from Windows File Explorer
The following data shows the network traffic frames for authenticating a user who logs in to SOLIDWORKS PDM from Windows File Explorer.
|
|---|
Logging in to SOLIDWORKS PDM from the SOLIDWORKS PDM System Tray Icon
The following data shows the network traffic frames for authenticating a user who logs in to SOLIDWORKS PDM by using the SOLIDWORKS PDM system tray icon.
| Frame | Time Delta | Source | Destination | Description |
|---|---|---|---|---|
| 2280 | 717.9705707 | Client | Server | KerberosV5:AS Request Cname: Username |
| 2283 | 0.0029345 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_PREAUTH_REQUIRED |
| 2290 | 0.0068091 | Client | Server | KerberosV5:AS Request Cname: Username |
| 2291 | 0.0070625 | Server | Client | KerberosV5:AS Response Ticket[Realm: DomainName |
| Total: | 717.9873768 | |||
| 481 | 0 | Client | Server | KerberosV5:AS Request Cname: Username |
| 501 | 0.2029959 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_PREAUTH_REQUIRED |
| 518 | 0.2035259 | Client | Server | KerberosV5:AS Request Cname: Username |
| 526 | 0.2029223 | Server | Client | KerberosV5:AS Response Ticket[Realm: DomainName |
| Total: | 0.6094441 | |||
| 1113 | 55.8490036 | Client | Server | KerberosV5:AS Request Cname: ksr5 Realm: Username |
| 1146 | 0.202886 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_PREAUTH_REQUIRED |
| 1157 | 0.2033152 | Client | Server | KerberosV5:AS Request Cname: ksr5 Realm: Username |
| 1162 | 0.2032646 | Server | Client | KerberosV5:AS Response Ticket[Realm: DomainName |
| Total: | 56.4584694 | |||
| 1661 | 5.39689 | Client | Server | KerberosV5:AS Request Cname: ksr5 Realm: Username |
| 1665 | 0.2027324 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_PREAUTH_REQUIRED |
| 1686 | 0.2150048 | Client | Server | KerberosV5:AS Request Cname: ksr5 Realm: Username |
| 1715 | 0.2031275 | Server | Client | KerberosV5:AS Response Ticket[Realm: DomainName |
| Total: | 6.0177547 | |||
| 4770 | 97.4056427 | Client | Server | KerberosV5:AS Request Cname: ksr5 Realm: Username |
| 4776 | 0.2023626 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_PREAUTH_REQUIRED |
| 4789 | 0.2031059 | Client | Server | KerberosV5:AS Request Cname: ksr5 Realm: Username |
| 4808 | 0.2004279 | Server | Client | KerberosV5:AS Response Ticket[Realm: DomainName |
| Total: | 98.0115391 | |||
| 5185 | 40.1620933 | Client | Server | KerberosV5:AS Request Cname: ksr5 Realm: Username |
| 5192 | 0.2031213 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_PREAUTH_REQUIRED |
| 5209 | 0.2032925 | Client | Server | KerberosV5:AS Request Cname: ksr5 Realm: Username |
| 5216 | 0.2030359 | Server | Client | KerberosV5:AS Response Ticket[Realm: DomainName |
| Total: | 40.771543 | |||
| 5824 | 232.0180162 | Client | Server | KerberosV5:AS Request Cname: ksr5 Realm: Username |
| 5868 | 0.2031231 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_PREAUTH_REQUIRED |
| 5882 | 0.2032239 | Client | Server | KerberosV5:AS Request Cname: ksr5 Realm: Username |
| 5893 | 0.2038987 | Server | Client | KerberosV5:AS Response Ticket[Realm: DomainName |
| Total: | 232.6282619 | |||
| 6411 | 92.935691 | Client | Server | KerberosV5:AS Request Cname: ksr5 Realm: Username |
| 6415 | 0.2031345 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_PREAUTH_REQUIRED |
| 6429 | 0.2093147 | Client | Server | KerberosV5:AS Request Cname: ksr5 Realm: Username |
| 6433 | 0.2030388 | Server | Client | KerberosV5:AS Response Ticket[Realm: DomainName |
| Total: | 93.551179 | |||
| 6967 | 48.7206364 | Client | Server | KerberosV5:AS Request Cname: ksr5 Realm: Username |
| 6988 | 0.2032382 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_PREAUTH_REQUIRED |
| 6997 | 0.2031312 | Client | Server | KerberosV5:AS Request Cname: ksr5 Realm: Username |
| 7004 | 0.2028728 | Server | Client | KerberosV5:AS Response Ticket[Realm: DomainName |
| Total: | 49.3298786 | |||
| 7461 | 3.6514582 | Client | Server | KerberosV5:AS Request Cname: ksr5 Realm: Username |
| 7466 | 0.2030534 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_PREAUTH_REQUIRED |
| 7476 | 0.2032841 | Client | Server | KerberosV5:AS Request Cname: ksr5 Realm: Username |
| 7500 | 0.2037158 | Server | Client | KerberosV5:AS Response Ticket[Realm: DomainName |
| Total: | 4.2615115 |
Logging in to SOLIDWORKS PDM from an Application
The following data shows the network traffic frames for authenticating a user who logs in to SOLIDWORKS PDM from an application. This test captures authentication from Microsoft Word.
| Frame | Time Delta | Source | Destination | Description |
|---|---|---|---|---|
| 376 | 0 | Client | Server | KerberosV5:AS Request Cname: Username |
| 388 | 0.2030447 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_PREAUTH_REQUIRED |
| 432 | 0.2031806 | Client | Server | KerberosV5:AS Request Cname: Username |
| 462 | 0.2033391 | Server | Client | KerberosV5:AS Response Ticket[Realm: DomainName |
| 502 | 0.8125269 | Client | Server | KerberosV5:AS Request Cname: Username |
| 515 | 0.2030315 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_PREAUTH_REQUIRED |
| 532 | 0.2032723 | Client | Server | KerberosV5:AS Request Cname: Username |
| 540 | 0.2029615 | Server | Client | KerberosV5:AS Response Ticket[Realm: DomainName |
| Total: | 2.0313566 | |||
| 1411 | 381.19851 | Client | Server | KerberosV5:AS Request Cname: Username |
| 1422 | 0.2032665 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_PREAUTH_REQUIRED |
| 1434 | 0.2122374 | Client | Server | KerberosV5:AS Request Cname: Username |
| 1455 | 0.2029223 | Server | Client | KerberosV5:AS Response Ticket[Realm: DomainName |
| 1557 | 1.422736 | Client | Server | KerberosV5:AS Request Cname: Username |
| 1560 | 0.2032943 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_PREAUTH_REQUIRED |
| 1576 | 0.2031535 | Client | Server | KerberosV5:AS Request Cname: Username |
| 1583 | 0.203029 | Server | Client | KerberosV5:AS Response Ticket[Realm: DomainName |
| Total: | 383.8491468 | |||
| 2054 | 88.796469 | Client | Server | KerberosV5:AS Request Cname: Username |
| 2058 | 0.2030388 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_PREAUTH_REQUIRED |
| 2087 | 0.2034057 | Client | Server | KerberosV5:AS Request Cname: Username |
| 2102 | 0.2097465 | Server | Client | KerberosV5:AS Response Ticket[Realm: DomainName |
| 2167 | 0.8182717 | Client | Server | KerberosV5:AS Request Cname: Username |
| 2173 | 0.2037788 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_PREAUTH_REQUIRED |
| 2188 | 0.2031173 | Client | Server | KerberosV5:AS Request Cname: Username |
| 2191 | 0.203203 | Server | Client | KerberosV5:AS Response Ticket[Realm: DomainName |
| Total: | 90.8410311 | |||
| 5915 | 1032.4965 | Client | Server | KerberosV5:AS Request Cname: Username |
| 5919 | 0.2028991 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_PREAUTH_REQUIRED |
| 5929 | 0.2038702 | Client | Server | KerberosV5:AS Request Cname: Username |
| 5932 | 0.2031051 | Server | Client | KerberosV5:AS Response Ticket[Realm: DomainName |
| 6075 | 2.234906 | Client | Server | KerberosV5:AS Request Cname: Username |
| 6077 | 0.2030623 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_PREAUTH_REQUIRED |
| 6087 | 0.2032228 | Client | Server | KerberosV5:AS Request Cname: Username |
| 6091 | 0.2030835 | Server | Client | KerberosV5:AS Response Ticket[Realm: DomainName |
| Total: | 1035.950644 | |||
| 6702 | 194.50258 | Client | Server | KerberosV5:AS Request Cname: Username |
| 6717 | 0.203 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_PREAUTH_REQUIRED |
| 6737 | 0.2033368 | Client | Server | KerberosV5:AS Request Cname: Username |
| 6767 | 0.2028504 | Server | Client | KerberosV5:AS Response Ticket[Realm: DomainName |
| 6811 | 0.8126468 | Client | Server | KerberosV5:AS Request Cname: Username |
| 6829 | 0.203151 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_PREAUTH_REQUIRED |
| 6841 | 0.2033885 | Client | Server | KerberosV5:AS Request Cname: Username |
| 6843 | 0.2032148 | Server | Client | KerberosV5:AS Response Ticket[Realm: DomainName |
| Total: | 196.5341646 | |||
| 7775 | 64.551252 | Client | Server | KerberosV5:AS Request Cname: Username |
| 7798 | 0.202897 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_PREAUTH_REQUIRED |
| 7830 | 0.2032265 | Client | Server | KerberosV5:AS Request Cname: Username |
| 7848 | 0.2032089 | Server | Client | KerberosV5:AS Response Ticket[Realm: DomainName |
| 7957 | 0.8104736 | Client | Server | KerberosV5:AS Request Cname: Username |
| 7962 | 0.2030531 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_PREAUTH_REQUIRED |
| 7982 | 0.2032844 | Client | Server | KerberosV5:AS Request Cname: Username |
| 7983 | 0.2029944 | Server | Client | KerberosV5:AS Response Ticket[Realm: DomainName |
| Total: | 66.58039 | |||
| 9604 | 80.290735 | Client | Server | KerberosV5:AS Request Cname: Username |
| 9617 | 0.203001 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_PREAUTH_REQUIRED |
| 9634 | 0.2041267 | Client | Server | KerberosV5:AS Request Cname: Username |
| 9680 | 0.2029194 | Server | Client | KerberosV5:AS Response Ticket[Realm: DomainName |
| 9824 | 0.8155179 | Client | Server | KerberosV5:AS Request Cname: Username |
| 9848 | 0.2125955 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_PREAUTH_REQUIRED |
| 9860 | 0.203199 | Client | Server | KerberosV5:AS Request Cname: Username |
| 9871 | 0.2030286 | Server | Client | KerberosV5:AS Response Ticket[Realm: DomainName |
| Total: | 82.335123 | |||
| 10734 | 414.51038 | Client | Server | KerberosV5:AS Request Cname: Username |
| 10748 | 0.2034233 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_PREAUTH_REQUIRED |
| 10759 | 0.2026715 | Client | Server | KerberosV5:AS Request Cname: Username |
| 10772 | 0.2030374 | Server | Client | KerberosV5:AS Response Ticket[Realm: DomainName |
| 10944 | 2.2347044 | Client | Server | KerberosV5:AS Request Cname: Username |
| 10984 | 0.202857 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_PREAUTH_REQUIRED |
| 10995 | 0.2121447 | Client | Server | KerberosV5:AS Request Cname: Username |
| 11004 | 0.2030205 | Server | Client | KerberosV5:AS Response Ticket[Realm: DomainName |
| Total: | 417.9722363 | |||
| 11494 | 34.408152 | Client | Server | KerberosV5:AS Request Cname: Username |
| 11528 | 0.2030268 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_PREAUTH_REQUIRED |
| 11544 | 0.2031781 | Client | Server | KerberosV5:AS Request Cname: Username |
| 11558 | 0.2029875 | Server | Client | KerberosV5:AS Response Ticket[Realm: DomainName |
| 11584 | 0.4063415 | Client | Server | KerberosV5:AS Request Cname: Username |
| 11625 | 0.2029901 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_PREAUTH_REQUIRED |
| 11633 | 0.2090577 | Client | Server | KerberosV5:AS Request Cname: Username |
| 11643 | 0.2043449 | Server | Client | KerberosV5:AS Response Ticket[Realm: DomainName |
| Total: | 36.0400786 | |||
| 12074 | 92.008649 | Client | Server | KerberosV5:AS Request Cname: Username |
| 12077 | 0.2027482 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_PREAUTH_REQUIRED |
| 12089 | 0.2033064 | Client | Server | KerberosV5:AS Request Cname: Username |
| 12100 | 0.2031312 | Server | Client | KerberosV5:AS Response Ticket[Realm: DomainName |
| 12156 | 0.8130305 | Client | Server | KerberosV5:AS Request Cname: Username |
| 12161 | 0.203122 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_PREAUTH_REQUIRED |
| 12173 | 0.2133041 | Client | Server | KerberosV5:AS Request Cname: Username |
| 12181 | 0.2048614 | Server | Client | KerberosV5:AS Response Ticket[Realm: DomainName |
| Total: | 94.0521526 |
Logging in to a Vault from SOLIDWORKS (‘SOLIDWORKS PDM Add-in’ Active and ‘Automatic Windows Login’ Option Active)
The following data shows the network traffic frames for authenticating a user who logs in to the SOLIDWORKS PDM vault from the SOLIDWORKS application, with the SOLIDWORKS PDM Add in active and the Automatic Windows Login option active.
| Frame | Time Delta | Source | Destination | Description |
|---|---|---|---|---|
| 113 | 0 | Client | Server | KerberosV5:TGS Request |
| 117 | 0.006175 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_S_PRINCIPAL_UNKNOWN (7) |
| 128 | 0.0934081 | Client | Server | KerberosV5:TGS Request |
| 133 | 0.0080283 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_S_PRINCIPAL_UNKNOWN (7) |
| 151 | 0.6925275 | Client | Server | KerberosV5:TGS Request |
| 155 | 0.0138442 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_S_PRINCIPAL_UNKNOWN (7) |
| 189 | 0.2806379 | Client | Server | KerberosV5:TGS Request |
| 193 | 0.0042645 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_S_PRINCIPAL_UNKNOWN (7) |
| Total: - | 50.9339003 | |||
| 423 | 336.7309687 | Client | Server | KerberosV5:TGS Request |
| 427 | 0.0133746 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_S_PRINCIPAL_UNKNOWN (7) |
| 437 | 0.1333598 | Client | Server | KerberosV5:TGS Request |
| 442 | 0.0089968 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_S_PRINCIPAL_UNKNOWN (7) |
| 462 | 0.6926089 | Client | Server | KerberosV5:TGS Request |
| 467 | 0.0166439 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_S_PRINCIPAL_UNKNOWN (7) |
| 487 | 0.301318 | Client | Server | KerberosV5:TGS Request |
| 493 | 0.0109919 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_S_PRINCIPAL_UNKNOWN (7) |
| Total: - | 3090.733873 | |||
| 121 | 0 | Client | Server | KerberosV5:TGS Request |
| 125 | 0.005796 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_S_PRINCIPAL_UNKNOWN (7) |
| 144 | 0.1443401 | Client | Server | KerberosV5:TGS Request |
| 148 | 0.0056075 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_S_PRINCIPAL_UNKNOWN (7) |
| 183 | 0.9003602 | Client | Server | KerberosV5:TGS Request |
| 187 | 0.0092653 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_S_PRINCIPAL_UNKNOWN (7) |
| Total: - | 1.0653691 | |||
| 3301 | 28.5995829 | Client | Server | KerberosV5:TGS Request |
| 3305 | 0.0034845 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_S_PRINCIPAL_UNKNOWN (7) |
| 3313 | 0.1046484 | Client | Server | KerberosV5:TGS Request |
| 3317 | 0.0031146 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_S_PRINCIPAL_UNKNOWN (7) |
| 3339 | 0.5562524 | Client | Server | KerberosV5:TGS Request |
| 3343 | 0.0032703 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_S_PRINCIPAL_UNKNOWN (7) |
| Total: - | 29.2703531 | |||
| 15339 | 2.1721386 | Client | Server | KerberosV5:TGS Request |
| 15342 | 0.0033861 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_S_PRINCIPAL_UNKNOWN (7) |
| 15355 | 0.0918769 | Client | Server | KerberosV5:TGS Request |
| 15358 | 0.0029624 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_S_PRINCIPAL_UNKNOWN (7) |
| Total: - | 2.270364 | |||
| 16123 | 2.4881041 | Client | Server | KerberosV5:TGS Request |
| 16126 | 0.0035796 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_S_PRINCIPAL_UNKNOWN (7) |
| 16133 | 0.1239486 | Client | Server | KerberosV5:TGS Request |
| 16136 | 0.0031406 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_S_PRINCIPAL_UNKNOWN (7) |
| Total: - | 2.6187729 | |||
| 16499 | 2.246752 | Client | Server | KerberosV5:TGS Request |
| 16502 | 0.0034911 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_S_PRINCIPAL_UNKNOWN (7) |
| 16509 | 0.0663839 | Client | Server | KerberosV5:TGS Request |
| 16512 | 0.0032269 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_S_PRINCIPAL_UNKNOWN (7) |
| Total: - | 2.3198539 | |||
| 16885 | 2.5169136 | Client | Server | KerberosV5:TGS Request |
| 16888 | 0.0035122 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_S_PRINCIPAL_UNKNOWN (7) |
| 16898 | 0.0662104 | Client | Server | KerberosV5:TGS Request |
| 16901 | 0.0032535 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_S_PRINCIPAL_UNKNOWN (7) |
| Total: - | 2.5898897 | |||
| 17260 | 2.3245346 | Client | Server | KerberosV5:TGS Request |
| 17263 | 0.0032553 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_S_PRINCIPAL_UNKNOWN (7) |
| 17273 | 0.0579693 | Client | Server | KerberosV5:TGS Request |
| 17276 | 0.0030544 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_S_PRINCIPAL_UNKNOWN (7) |
| Total: - | 2.3888136 | |||
| 17609 | 0.7714774 | Client | Server | KerberosV5:TGS Request |
| 17612 | 0.0035213 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_S_PRINCIPAL_UNKNOWN (7) |
| 17621 | 0.0581616 | Client | Server | KerberosV5:TGS Request |
| 17624 | 0.0032354 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_S_PRINCIPAL_UNKNOWN (7) |
| Total: - | 0.8363957 |
Logging in to a Vault from SOLIDWORKS (‘SOLIDWORKS PDM Add-in’ Active and ‘Automatic Windows Login’ Option Inactive or Manual Log in)
The following data shows the network traffic frames for authenticating a user when the user logs in to the SOLIDWORKS PDM vault from the SOLIDWORKS application, with the SOLIDWORKS PDM Add-in active and the Automatic Windows Login option deactivated.
| Frame | Time Delta | Source | Destination | Description |
|---|---|---|---|---|
| 5314 | 0.0008466 | Client | Server | KerberosV5:TGS Request |
| 5317 | 0.0061107 | Server | Client | KerberosV5:TGS Response Cname: Username |
| 5466 | 5.5049848 | Client | Server | KerberosV5:AS Request Cname: Username Realm:DomainName Sname: krbtgt/DomainName |
| 5467 | 0.0030562 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_PREAUTH_REQUIRED (25) |
| 5475 | 0.0064484 | Client | Server | KerberosV5:AS Request Cname: Username Realm:DomainName Sname: krbtgt/DomainName |
| 5476 | 0.0101586 | Server | Client | KerberosV5:AS Response Ticket[Realm:DomainName, Sname: krbtgt/DomainName] |
| 5505 | 0.1468073 | Client | Server | KerberosV5:AS Request Cname: Username Realm:DomainName Sname: krbtgt/DomainName |
| 5506 | 0.0028506 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_PREAUTH_REQUIRED (25) |
| 5528 | 0.006581 | Client | Server | KerberosV5:AS Request Cname: Username Realm:DomainName Sname: krbtgt/DomainName |
| 5529 | 0.0067969 | Server | Client | KerberosV5:AS Response Ticket[Realm:DomainName, Sname: krbtgt/DomainName] |
| Total: | 5.6946411 | |||
| 6005 | 5.1361217 | Client | Server | KerberosV5:AS Request Cname: Username Realm:DomainName Sname: krbtgt/DomainName |
| 6006 | 0.0026594 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_PREAUTH_REQUIRED (25) |
| 6013 | 0.0064508 | Client | Server | KerberosV5:AS Request Cname: Username Realm:DomainName Sname: krbtgt/DomainName |
| 6014 | 0.0064564 | Server | Client | KerberosV5:AS Response Ticket[Realm:DomainName, Sname: krbtgt/DomainName] |
| 6044 | 0.1336028 | Client | Server | KerberosV5:AS Request Cname: Username Realm:DomainName Sname: krbtgt/DomainName |
| 6045 | 0.0025972 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_PREAUTH_REQUIRED (25) |
| 6052 | 0.0063799 | Client | Server | KerberosV5:AS Request Cname: Username Realm:DomainName Sname: krbtgt/DomainName |
| 6053 | 0.0099026 | Server | Client | KerberosV5:AS Response Ticket[Realm:DomainName, Sname: krbtgt/DomainName] |
| Total:- | 5.3041708 | |||
| 6525 | 5.8373848 | Client | Server | KerberosV5:AS Request Cname: Username Realm:DomainName Sname: krbtgt/DomainName |
| 6526 | 0.0028251 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_PREAUTH_REQUIRED (25) |
| 6533 | 0.0072203 | Client | Server | KerberosV5:AS Request Cname: Username Realm:DomainName Sname: krbtgt/DomainName |
| 6536 | 0.0064719 | Server | Client | KerberosV5:AS Response Ticket[Realm:DomainName, Sname: krbtgt/DomainName] |
| 6558 | 0.0828321 | Client | Server | KerberosV5:AS Request Cname: Username Realm:DomainName Sname: krbtgt/DomainName |
| 6559 | 0.0026661 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_PREAUTH_REQUIRED (25) |
| 6566 | 0.006274 | Client | Server | KerberosV5:AS Request Cname: Username Realm:DomainName Sname: krbtgt/DomainName |
| 6567 | 0.0063195 | Server | Client | KerberosV5:AS Response Ticket[Realm:DomainName, Sname: krbtgt/DomainName] |
| Total:- | 5.9519938 | |||
| 6991 | 6.030355 | Client | Server | KerberosV5:AS Request Cname: Username Realm:DomainName Sname: krbtgt/DomainName |
| 6992 | 0.0031735 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_PREAUTH_REQUIRED (25) |
| 6999 | 0.0065112 | Client | Server | KerberosV5:AS Request Cname: Username Realm:DomainName Sname: krbtgt/DomainName |
| 7000 | 0.0068763 | Server | Client | KerberosV5:AS Response Ticket[Realm:DomainName, Sname: krbtgt/DomainName] |
| 7031 | 0.0999083 | Client | Server | KerberosV5:AS Request Cname: Username Realm:DomainName Sname: krbtgt/DomainName |
| 7032 | 0.0028682 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_PREAUTH_REQUIRED (25) |
| 7039 | 0.0062148 | Client | Server | KerberosV5:AS Request Cname: Username Realm:DomainName Sname: krbtgt/DomainName |
| 7040 | 0.0074067 | Server | Client | KerberosV5:AS Response Ticket[Realm:DomainName, Sname: krbtgt/DomainName] |
| Total:- | 6.163314 | |||
| 7728 | 5.6346342 | Client | Server | KerberosV5:AS Request Cname: Username Realm:DomainName Sname: krbtgt/DomainName |
| 7729 | 0.0027979 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_PREAUTH_REQUIRED (25) |
| 7736 | 0.0067241 | Client | Server | KerberosV5:AS Request Cname: Username Realm:DomainName Sname: krbtgt/DomainName |
| 7737 | 0.0065652 | Server | Client | KerberosV5:AS Response Ticket[Realm:DomainName, Sname: krbtgt/DomainName] |
| 7765 | 0.1799474 | Client | Server | KerberosV5:AS Request Cname: Username Realm:DomainName Sname: krbtgt/DomainName |
| 7766 | 0.0028372 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_PREAUTH_REQUIRED (25) |
| 7773 | 0.006286 | Client | Server | KerberosV5:AS Request Cname: Username Realm:DomainName Sname: krbtgt/DomainName |
| 7774 | 0.0068458 | Server | Client | KerberosV5:AS Response Ticket[Realm:DomainName, Sname: krbtgt/DomainName] |
| Total:- | 5.8466378 | |||
| 8538 | 16.67915 | Client | Server | KerberosV5:AS Request Cname: Username Realm:DomainName Sname: krbtgt/DomainName |
| 8540 | 0.0029779 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_PREAUTH_REQUIRED (25) |
| 8547 | 0.0083393 | Client | Server | KerberosV5:AS Request Cname: Username Realm:DomainName Sname: krbtgt/DomainName |
| 8548 | 0.0104938 | Server | Client | KerberosV5:AS Response Ticket[Realm:DomainName, Sname: krbtgt/DomainName] |
| 8579 | 0.1030921 | Client | Server | KerberosV5:AS Request Cname: Username Realm:DomainName Sname: krbtgt/DomainName |
| 8580 | 0.0028301 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_PREAUTH_REQUIRED (25) |
| 8587 | 0.0062555 | Client | Server | KerberosV5:AS Request Cname: Username Realm:DomainName Sname: krbtgt/DomainName |
| 8588 | 0.0066889 | Server | Client | KerberosV5:AS Response Ticket[Realm:DomainName, Sname: krbtgt/DomainName] |
| Total:- | 16.819828 | |||
| 12619 | 8.64269 | Client | Server | KerberosV5:AS Request Cname: Username Realm:DomainName Sname: krbtgt/DomainName |
| 12620 | 0.0031236 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_PREAUTH_REQUIRED (25) |
| 12627 | 0.0064403 | Client | Server | KerberosV5:AS Request Cname: Username Realm:DomainName Sname: krbtgt/DomainName |
| 12628 | 0.011138 | Server | Client | KerberosV5:AS Response Ticket[Realm:DomainName, Sname: krbtgt/DomainName] |
| 12651 | 0.0897177 | Client | Server | KerberosV5:AS Request Cname: Username Realm:DomainName Sname: krbtgt/DomainName |
| 12652 | 0.003012 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_PREAUTH_REQUIRED (25) |
| 12660 | 0.0078545 | Client | Server | KerberosV5:AS Request Cname: Username Realm:DomainName Sname: krbtgt/DomainName |
| 12661 | 0.0069036 | Server | Client | KerberosV5:AS Response Ticket[Realm:DomainName, Sname: krbtgt/DomainName] |
| Total:- | 8.7708797 | |||
| 13177 | 6.5569853 | Client | Server | KerberosV5:AS Request Cname: Username Realm:DomainName Sname: krbtgt/DomainName |
| 13178 | 0.0027157 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_PREAUTH_REQUIRED (25) |
| 13187 | 0.0064406 | Client | Server | KerberosV5:AS Request Cname: Username Realm:DomainName Sname: krbtgt/DomainName |
| 13188 | 0.0100123 | Server | Client | KerberosV5:AS Response Ticket[Realm:DomainName, Sname: krbtgt/DomainName] |
| 13213 | 0.1987031 | Client | Server | KerberosV5:AS Request Cname: Username Realm:DomainName Sname: krbtgt/DomainName |
| 13214 | 0.0029474 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_PREAUTH_REQUIRED (25) |
| 13221 | 0.00612 | Client | Server | KerberosV5:AS Request Cname: Username Realm:DomainName Sname: krbtgt/DomainName |
| 13222 | 0.0065948 | Server | Client | KerberosV5:AS Response Ticket[Realm:DomainName, Sname: krbtgt/DomainName] |
| Total:- | 6.7905192 | |||
| 13725 | 8.8105237 | Client | Server | KerberosV5:AS Request Cname: Username Realm:DomainName Sname: krbtgt/DomainName |
| 13726 | 0.0028692 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_PREAUTH_REQUIRED (25) |
| 13733 | 0.0065499 | Client | Server | KerberosV5:AS Request Cname: Username Realm:DomainName Sname: krbtgt/DomainName |
| 13734 | 0.0102149 | Server | Client | KerberosV5:AS Response Ticket[Realm:DomainName, Sname: krbtgt/DomainName] |
| 13763 | 0.099776 | Client | Server | KerberosV5:AS Request Cname: Username Realm:DomainName Sname: krbtgt/DomainName |
| 13764 | 0.0026328 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_PREAUTH_REQUIRED (25) |
| 13771 | 0.006347 | Client | Server | KerberosV5:AS Request Cname: Username Realm:DomainName Sname: krbtgt/DomainName |
| 13772 | 0.00633 | Server | Client | KerberosV5:AS Response Ticket[Realm:DomainName, Sname: krbtgt/DomainName] |
| Total:- | 8.9452435 | |||
| 14172 | 5.9494108 | Client | Server | KerberosV5:AS Request Cname: Username Realm:DomainName Sname: krbtgt/DomainName |
| 14173 | 0.0028882 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_PREAUTH_REQUIRED (25) |
| 14180 | 0.0066244 | Client | Server | KerberosV5:AS Request Cname: Username Realm:DomainName Sname: krbtgt/DomainName |
| 14181 | 0.0098296 | Server | Client | KerberosV5:AS Response Ticket[Realm:DomainName, Sname: krbtgt/DomainName] |
| 14203 | 0.0922423 | Client | Server | KerberosV5:AS Request Cname: Username Realm:DomainName Sname: krbtgt/DomainName |
| 14204 | 0.0031741 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_PREAUTH_REQUIRED (25) |
| 14211 | 0.0063537 | Client | Server | KerberosV5:AS Request Cname: Username Realm:DomainName Sname: krbtgt/DomainName |
| 14212 | 0.0079818 | Server | Client | KerberosV5:AS Response Ticket[Realm:DomainName, Sname: krbtgt/DomainName] |
| Total:- | 6.0785049 | |||
| 14883 | 6.8675993 | Client | Server | KerberosV5:AS Request Cname: Username Realm:DomainName Sname: krbtgt/DomainName |
| 14884 | 0.0028098 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_PREAUTH_REQUIRED (25) |
| 14891 | 0.006757 | Client | Server | KerberosV5:AS Request Cname: Username Realm:DomainName Sname: krbtgt/DomainName |
| 14892 | 0.0066018 | Server | Client | KerberosV5:AS Response Ticket[Realm:DomainName, Sname: krbtgt/DomainName] |
| 14915 | 0.1428133 | Client | Server | KerberosV5:AS Request Cname: Username Realm:DomainName Sname: krbtgt/DomainName |
| 14916 | 0.0026196 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_PREAUTH_REQUIRED (25) |
| 14923 | 0.0063329 | Client | Server | KerberosV5:AS Request Cname: Username Realm:DomainName Sname: krbtgt/DomainName |
| 14924 | 0.0064948 | Server | Client | KerberosV5:AS Response Ticket[Realm:DomainName, Sname: krbtgt/DomainName] |
| Total:- | 7.0420285 |
Logging in to a Vault from SOLIDWORKS (‘SOLIDWORKS PDM Add-in’ Inactive and ‘Automatic Windows Login’ Option Active)
The following data shows the network traffic frames for authenticating a user when the user logs in to the SOLIDWORKS PDM vault from the SOLIDWORKS application, with the SOLIDWORKS PDM Add-in deactivated and the Automatic Windows Login option is active.
| Frame | Time Delta | Source | Destination | Description |
|---|---|---|---|---|
| 17977 | 2.906483 | Client | Server | KerberosV5:TGS Request |
| 17980 | 0.003484 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_S_PRINCIPAL_UNKNOWN (7) |
| 17990 | 0.1554982 | Client | Server | KerberosV5:TGS Request |
| 17993 | 0.0041782 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_S_PRINCIPAL_UNKNOWN (7) |
| Total: - | 3.0696434 | |||
| 477 | 0.3812142 | Client | Server | KerberosV5:TGS Request |
| 480 | 0.001812 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_S_PRINCIPAL_UNKNOWN (7) |
| 517 | 0.4399737 | Client | Server | KerberosV5:TGS Request |
| 520 | 0.0017818 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_S_PRINCIPAL_UNKNOWN (7) |
| Total: - | 0.8247817 | |||
| 745 | 146.7633834 | Client | Server | KerberosV5:TGS Request |
| 748 | 0.001317 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_S_PRINCIPAL_UNKNOWN (7) |
| 758 | 0.0766921 | Client | Server | KerberosV5:TGS Request |
| 761 | 0.0016043 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_S_PRINCIPAL_UNKNOWN (7) |
| Total: - | 146.8429968 | |||
| 1553 | 36.6925445 | Client | Server | KerberosV5:TGS Request |
| 1556 | 0.0017422 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_S_PRINCIPAL_UNKNOWN (7) |
| 1567 | 0.0760065 | Client | Server | KerberosV5:TGS Request |
| 1570 | 0.0016319 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_S_PRINCIPAL_UNKNOWN (7) |
| Total: - | 36.7719251 | |||
| 2504 | 2.4465844 | Client | Server | KerberosV5:TGS Request |
| 2507 | 0.0017844 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_S_PRINCIPAL_UNKNOWN (7) |
| 2515 | 0.0760006 | Client | Server | KerberosV5:TGS Request |
| 2518 | 0.0016644 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_S_PRINCIPAL_UNKNOWN (7) |
| Total: - | 2.5260338 | |||
| 2832 | 3.5504582 | Client | Server | KerberosV5:TGS Request |
| 2835 | 0.0036172 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_S_PRINCIPAL_UNKNOWN (7) |
| 2843 | 0.0743951 | Client | Server | KerberosV5:TGS Request |
| 2846 | 0.0033146 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_S_PRINCIPAL_UNKNOWN (7) |
| Total: - | 3.6317851 | |||
| 3202 | 54.2534682 | Client | Server | KerberosV5:TGS Request |
| 3205 | 0.003491 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_S_PRINCIPAL_UNKNOWN (7) |
| 3215 | 0.0743937 | Client | Server | KerberosV5:TGS Request |
| 3218 | 0.0032351 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_S_PRINCIPAL_UNKNOWN (7) |
| Total: - | 54.334588 | |||
| 3572 | 150.3776996 | Client | Server | KerberosV5:TGS Request |
| 3575 | 0.0030315 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_S_PRINCIPAL_UNKNOWN (7) |
| 3587 | 0.121336 | Client | Server | KerberosV5:TGS Request |
| 3590 | 0.0030463 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_S_PRINCIPAL_UNKNOWN (7) |
| Total: - | 150.5051134 | |||
| 3861 | 129.3647896 | Client | Server | KerberosV5:TGS Request |
| 3864 | 0.0035805 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_S_PRINCIPAL_UNKNOWN (7) |
| 3880 | 0.0900717 | Client | Server | KerberosV5:TGS Request |
| 3883 | 0.0033433 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_S_PRINCIPAL_UNKNOWN (7) |
| Total: - | 129.4617851 | |||
| 4114 | 41.2429679 | Client | Server | KerberosV5:TGS Request |
| 4117 | 0.0035664 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_S_PRINCIPAL_UNKNOWN (7) |
| 4126 | 0.074343 | Client | Server | KerberosV5:TGS Request |
| 4129 | 0.003179 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_S_PRINCIPAL_UNKNOWN (7) |
| Total: - | 41.3240563 |
Authentication Testing Results Summary
The test results indicate that authentication typically takes from milliseconds to a few seconds to complete each authentication operation.
If the Time Delta is larger than you expect, this could indicate an expensive request, a slow server, or some other slow infrastructure. This may in turn need further investigation to identify the root cause of the issue.
| Frame | Time Delta | Source | Destination | Description |
|---|---|---|---|---|
| 481 | 0 | Client | Server | KerberosV5:AS Request Cname: Username |
| 501 | 0.2029959 | Server | Client | KerberosV5:KRB_ERROR - KDC_ERR_PREAUTH_REQUIRED |
| 518 | 0.2035259 | Client | Server | KerberosV5:AS Request Cname: Username |
| 526 | 0.2029223 | Server | Client | KerberosV5:AS Response Ticket[Realm: DomainName |
| Total: | 0.6094441 |
The previous image depicts the following:
The client takes approximately 0.20ms to request a ticket from the server (shown in blue highlight).
The server takes approximately 0.20ms to respond to the client with the ticket (shown in yellow highlight).
The total Delta Time for the pairs traced in this example is approximately 0.60ms, which indicates a good authentication time.
If the server response time is significantly higher than the client setup time, then this could indicate that the problem is on the server end, or is a related network issue. If there are any retransmissions of the request, this could indicate that the network is dropping packets somewhere, or possibly an unreliable network connection is in use (for example - connecting through wireless with a poor wireless signal).
What Can Cause Authentication Delays and Issues?
This section describes some of the more common issues than can cause delays and issues when authenticating.
Network Infrastructure
DNS resolution
If DNS resolution fails, then the system goes to a broadcast mode to resolve the name to the IP address of an authenticating domain controller (DC) or DNS server. Crossing subnets is an issue for broadcast resolution, which causes a delay. The cause could be because something did not update with a new IP address. It could be related to a server, a client computer, or a network component.
Domain controller location
To optimize latency performance, it is always best to connect to a local DC on the same LAN rather than over a WAN at a remote location. This is especially true if the DC is in a different geographical location than the location from which you are connecting. Latency is higher (longer response time) from a remote DC, which in turn means that it takes longer to authenticate the user with SOLIDWORKS PDM. This has an impact on user productivity because of the wait time
TCP/IP connectivity issues
For Kerberos authentication to occur, TCP/IP network connectivity must exist between the client computer, the domain controller, and the target server. When viable, the recommendation is to use wired network connections instead of wireless network connections. To optimize reliability and performance, domain controllers should also have multiple network interface controller (NIC) cards, with multiple network patch cables that connect to redundant network switches. If you do use computers with wireless connections, ensure that the network maintains a strong wireless signal. To enjoy the best possible wireless speeds and reliability, use one of the latest generations of mainstream releases of wireless standards for both wireless access point hardware and network cards in desktop and laptop computers.
At the time of this SolidPractice update, the latest standards include 802.11ac (preferable) and 802.11n. However, it is advisable to investigate if there are any newer protocols available, because wireless technology is constantly improving.
It is also advisable to ensure that laptop and notebook computers with both a wireless adapter and a physical network adaptor are set to use a wired connection by default (when physically plugged into network) even when a wireless network connection is available. Windows defaults to connecting to a wireless network connection as a priority in the network connections order list.
Time service
A DC in an Active Directory environment acts as an authoritative source of time for its domain. This ensures that the entire domain has the same time.
For Kerberos authentication to function correctly, all domains and forests in a network should use the same time source so that the time on all network computers synchronizes properly.
Server delegation
You may receive some Kerberos authentication errors if you do not configure server delegation on the archive server. Although this is not visible SOLIDWORKS PDM users, these errors can appear when you capture the Kerberos authentication traffic. In a production environment, you might want to configure delegation on the archive server, which would likely reduce the number of Kerberos authentication errors. For information about how to set up server delegation, see the following documentation:
The section “Configuring the Active Directory Domain Controller” in the “SOLIDWORKS PDM Administration Guide.”
Network User Account Configuration
It is a best practice to place users in AD groups and then apply the relevant security access to log in to their local DC. This is an especially good idea for small companies that only have a small number of users. This reduces the time that AD takes to authenticate, and reduces WAN traffic.
We hope that you find this document informational and useful and request that you leave a brief feedback about the topics that you want us to cover in the next revision of this document. Click here for a complete list of SolidPractices documents available from DS SOLIDWORKS Corp.
