Symptom
When using SASL authentication (Kerberos V5), the following error appears in the log file:
(Directory Server) Authenticating user "..." using SASL mechanism "GSSAPI" with KDC address "..." and realm "..."...
(Directory Server) Successfully established a new connection to "...".
Above message may appear multiple times.
(Directory Server) Failed to authenticate user.
Cause
FME Flow did not have the right privileges to find the user. This may be caused by the service account setting 'Do not require Kerberos preauthentication'.
Resolution
Kerberos pre-authentication must be enabled for the service account. See Updating the Windows Domain Configuration for information on how to configure the service account.