Ensure a Kerberos client is installed on the database server computer, including the GSS-API library.

The database server -z output lists the name of the library that it is attempting to load. Verify the library name is correct. If necessary, use the -kl option to specify the correct library name.

Ensure the directory and any supporting libraries is listed in the library path (%PATH% on Windows).

If the database server -z output states the GSS-API library was missing entry points, then the library is not a supported Kerberos Version 5 GSS-API library.

Ensure there is a principal for server-name@REALM in the KDC. Principals are case sensitive, so ensure the database server name is in the same case as the user portion of the principal name.

Ensure the name of the SQL Anywhere server is the primary/user portion of the principal.

Ensure that the server's principal has been extracted to a keytab file and the keytab file is in the correct location for the Kerberos client.

If the default realm for the Kerberos client on the database server computer is different from the realm in the server principal, use the -kr option to specify the realm in the server principal.

Check the database server diagnostic messages. Some problems with the keytab file used by the server are not detected until a client attempts to authenticate.

Ensure a Kerberos client is installed on the client computer, including the GSS-API library.

The file specified by LogFile lists the name of the library that it is attempting to load. Verify that the library name is correct, and use the Kerberos connection parameter to specify the correct library name, if necessary.

Ensure that the directory including any supporting libraries is listed in the library path (%PATH% on Windows).

If the LogFile output states the GSS-API library was missing entry points, then the library is not a supported Kerberos Version 5 GSS-API library.

Ensure the database server has enabled Kerberos logins by specifying one or more of the -krb, -kl, or -kr server options.

Ensure Kerberos logins are supported by SQL Anywhere on both the client and server platforms. See Kerberos clients.

Ensure the user is logged into Kerberos and has a valid ticket-granting ticket that has not expired.

Ensure the client computer and server computer both have their time synchronized to within less than 5 minutes.

The public or temporary public database option setting for the login_mode option must include the value Kerberos to allow Kerberos logins.

The Kerberos principal must be mapped to a database user ID using the GRANT KERBEROS LOGIN statement. Note the full client principal including the realm must be provided to the GRANT KERBEROS LOGIN statement, and principals which differ only in the instance or realm are treated as different.

Alternatively, if you want any valid Kerberos principal which has not be explicitly mapped to be able to connect, create the guest database user ID with a password using GRANT CONNECT.