CAM-AAA-0064 The function ‘bindToBestGCServer’ failed.

by ·0 Comments

Product:
Cognos BI 10.2.2 fix pack 7
Microsoft Windows 2012 R2 Server
Issue:
When a user from a different domain than the servers are in, try to login to Cognos Connection, they get this error message.
Error:
CAM-AAA-0064
The function ‘bindToBestGCServer’ failed.
Solution:
There are two Microsoft Windows domains, Domain A and Domain B, that have a forest trust. In Cognos Configuration you have setup two namespace – one for Domain A and one for Domain B. The Cognos servers are in Domain A.
On the Microsoft Windows server IIS manager you have set Windows authentication on the CGI-BIN folder for the Cognos Gateway.
The user selects the namespace he want to login to first when he reach the cognos connection webpage.
Inside Cognos Configuration you only need:
+ In the Value – Advanced properties window, click Add.
+ In the Name column, type singleSignonOption (Case sensitive)
+ In the Value column, type IdentityMapping (Case sensitive)
+ Click OK.
+ Save configuration and restart Service for the setting to take effect

…to make the login work.
If you have also enter multiDomainTree=true you get above error.
If you only have ONE namespace setup in Cognos, then if all domains are the same Active Directory Forest, you need to add this values
chaseReferrals = True
MultiDomainTrees = True

Solution is very depending one your network infrastructure setup, you need to test different configurations.

Authentication in One Domain Tree
If you set a parameter named chaseReferrals to true, users in the original authenticated domain and all child domains of the domain tree can log in to Cognos. Users above the original authenticated domain or in a different domain tree cannot log in.

Authentication in All Domain Trees in the ‘Forest’
If you set a parameter named MultiDomainTrees to true, users in all domain trees in the forest can log in to Cognos.

More information
http://www-01.ibm.com/support/docview.wss?uid=swg21341889

https://www.ibm.com/support/knowledgecenter/en/SSEP7J_10.2.2/com.ibm.swg.ba.cognos.c8pp_inst.10.2.2.doc/c_enabling_single_signon_between_actdirsrv_and_cog_comp.html#stp_SSO_active_drctry
http://www-01.ibm.com/support/docview.wss?uid=swg21339641