Unable to log on to BlackBerry Administration Service due to clock time skew

[BESadmin]

Unable to log on to BlackBerry Administration Service due to clock time skew

Doc ID : KB18177
Last Modified : 05-08-2009
Document Type : Support

Environment

• BlackBerry® Enterprise Server version 5.0
• SDR301644

Overview

If a time skew (difference) between the server clock on the computer hosting the BAS-AS and BAS-NCC and the Domain Controller exists, users will not be able to log on to BlackBerry Administration Service and the following error will be reported on the BlackBerry Administration Service page:

The username, password, or domain is not correct. Please correct the entry.

Cause

The error displayed by BlackBerry Administration Service is misleading because the root cause of this problem is that there is a time skew greater than 5 minutes between the clock on the server hosting the BlackBerry Administration Service and the clock of the Domain Controller providing authentication services (KDC role).

The following log line will display in the BAS-AS log file:

{http-<BASName>%2F10.200.26.82-443-1} [com.rim.bes.basplugin.activedirectory.ActiveDirect oryManagerBean] [INFO] [ADAU-1000] {u=SystemUser, t=32681} loginAsLdapUser failed to authenticate LDAP user=besadmin, realm=<Domain>, kdc=<Domain Controller providing KDC services) javax.security.auth.login.LoginException: Clock skew too great (37)

Note: The realm=<Domain> and kdc=<Domain Controller providing KDC services> values will be unique to each environment.

Resolution

Ensure that there is not a clock skew of greater than 5 minutes between the server that hosts the BAS-AS and BAS-NCC and the Domain Controller providing authentication services (KDC). This can be accomplished by making that particular Domain Controller the time source for the server hosting BAS-AS and BAS-NCC or having them synchronize their clocks/time from a common time source.

This can also be resolved by manually eliminating the Clock Skew (changing the time) between the 2 servers so that there is not a Time Skew in excess of 5 minutes.

Note: This issue is not inherent in the BlackBerry Administration Service but it is a result of the time skew in the environment between a Windows Server® and a Domain Controller.