Error: Clock Skew too great

Message

"Clock Skew too great while getting initial ticket."

Reason

This message from the Kerberos authentication server appears if the difference in system time between the LDAP and IWSVA servers is too large (more than three or four minutes). The default setting on IWSVA is five minutes.  This will be indicated in the KDC logs.

Solution

Change the clock settings on the IWSVA machine to match the LDAP server. Two convenient ways to accomplish this are to synchronize all machines to an atomic time server on the Internet, or use clock/time synchronization software between the machines.

• Note: Before changing the time on the Kerberos server, shut down all applications that require Kerberos tickets. On the IWSVA machine, stop and restart the IWSVA services.