> For the complete documentation index, see [llms.txt](https://help.security.gallagher.com/knowledge-hub/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.security.gallagher.com/knowledge-hub/products/cc-software/configure/identity-solutions-cardholders-and-ope/active-directory/active-directory-single-sign-on-common.md).

# Active Directory single sign-on common faults and scenarios

Resolve common Active Directory Single Sign-On faults, including SPN and logon-name issues.

## 1. SPN registration fails silently (insufficient privileges)

The domain service account lacks rights to register the SPN. **Symptom:** silent failure (especially pre-8.00); trace logs show a failed SPN update, for example `Failed to update account SPN: 8344`.

**Fix:** with local IT, add **Read/Write public information** to the domain service account and ensure it is a member of **Domain Users** (or apply the same permissions to the Gallagher Server Computer object for a local service account).

## 2. Domain policy issues

* **Kerberos encryption not allowed — error `8009030c`.** Enable **Kerberos encryption** for the operator account (the account's *Support Kerberos AES 128/256 bit encryption* options):

![Operator account properties, Account tab, with "This account supports Kerberos AES 128/256 bit encryption" ticked](https://328339335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6bM8WhlBE9BYizPWJaPN%2Fuploads%2Fgit-blob-e93b29f3b62de3f75d81fe2d857f48f271c27437%2FSECHUB-AD-SSO-03-kerberos-aes-encryption-account.png?alt=media)

* **Certificate problem — error `8009030e`** ("No credentials are available in the security package"). Investigate certificate issues. This surfaces as a Directory Service **Event 1220 (LDAP Interface)** warning:

![Windows Event Viewer showing Directory Service Event 1220 — "LDAP over SSL will be unavailable... Error value: 8009030e No credentials are available in the security package"](https://328339335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6bM8WhlBE9BYizPWJaPN%2Fuploads%2Fgit-blob-fe57096fc9e47be036e213b8745ba5ed200ea649%2FSECHUB-AD-SSO-04-event-1220-8009030e-ldaps.png?alt=media)

```
External writeup (third-party): [LDAPS 8009030e — No credentials available](https://itluke.online/2017/09/08/solved-id-1220-ldaps-8009030e-no-credentials-are-available-in-the-security-package/).
```

## 3. Incorrect `GGLCCSvc` SPN registration

`GGLCCSvc` must be registered to the **service account** the Command Centre service runs under. Common errors: registered on multiple instances, registered to the host machine instead of the service account, registered to the wrong account, or the wrong format. **Guideline:** Local System / Network Service → SPN under the **host machine**; otherwise → under the **service account**.

## 4. User logon name vs pre-Windows 2000 logon name mismatch

If an operator's **User logon name** and **User logon name (pre-Windows 2000)** differ, Command Centre may return *"The Operator's Windows Logon name is not a valid logon name."*

| Field                       | Example value             |
| --------------------------- | ------------------------- |
| User logon name             | `test.login@tstest.local` |
| Pre-Windows 2000 logon name | `tstest\test.login2`      |

![Active Directory account properties showing a User logon name of test.login@tstest.local but a pre-Windows 2000 name of TSTEST\test.login2](https://328339335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6bM8WhlBE9BYizPWJaPN%2Fuploads%2Fgit-blob-6856aab6d1577ddf71bc7f987fca1080cdd4ebf2%2FSECHUB-AD-SSO-05-logon-name-mismatch-account-tab.png?alt=media)

**Observed behaviour (SSO enabled):** the search (three dots next to the Windows logon field) returns the user, but clicking OK sets the Windows logon to `tstest.local\test.login`, the wrong value; only `tstest.local\test.login2` logs in successfully.

![Command Centre operator search returning the user test.login@tstest.local via Check Names](https://328339335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6bM8WhlBE9BYizPWJaPN%2Fuploads%2Fgit-blob-665c6ca3287c9f88ba535d3d6e927de75b767e4f%2FSECHUB-AD-SSO-06-search-check-names.png?alt=media)

![The operator's Windows logon field populated with the incorrect tstest.local\test.login value after clicking OK](https://328339335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6bM8WhlBE9BYizPWJaPN%2Fuploads%2Fgit-blob-cde50572efd4f9a504cbfef3602826af78669bf4%2FSECHUB-AD-SSO-07-windows-logon-set-wrong.png?alt=media)

**Workaround:** manually enter the correct **pre-Windows 2000 logon name** (`tstest.local\test.login2`) in the Windows logon field. This allows both saving and successful login.

***

🔗 **Related**

* [Single Sign-On - Troubleshooting](/knowledge-hub/products/cc-software/configure/identity-solutions-cardholders-and-ope/active-directory/active-directory-single-sign-on-troubl.md). The `setspn` commands.
* [Single Sign-On - Setting Up](/knowledge-hub/products/cc-software/configure/identity-solutions-cardholders-and-ope/active-directory/active-directory-single-sign-on-settin.md). Permissions and SPN registration.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://help.security.gallagher.com/knowledge-hub/products/cc-software/configure/identity-solutions-cardholders-and-ope/active-directory/active-directory-single-sign-on-common.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.