When configuring a Foglight agent that uses WinRM for remote data collection, authentication may fail if a short domain username (e.g., corp\db2admin) is used in the connection profile. This issue affects all agents that rely on WinRM, including DB2, SQL Server, and Windows OS agents.
WinRM supports multiple authentication protocols, including Basic, Negotiate, and Kerberos. These protocols have specific requirements for how user identities are formatted.
A short domain name refers to the NetBIOS-style domain name, typically used in the format DOMAIN\username (e.g., CORP\db2admin). While this format may work in some environments, it can cause issues in Kerberos-based authentication if the NetBIOS name is not properly mapped to the domain's fully qualified domain name (FQDN).
Kerberos authentication relies on:
If the short domain name cannot be resolved to the correct Kerberos realm, authentication will fail.
Use the appropriate user format based on the authentication method:
| Authentication Method | Recommended User Format | Notes |
|---|---|---|
| Basic | localuser | No domain prefix; must be a local user on the target host |
| Negotiate (Kerberos) | user@domain.com (UPN format) | Fully qualified; preferred for Kerberos |
DOMAIN\user (NetBIOS format) | May work if NetBIOS name maps correctly to the domain | |
| NTLM (if used) | DOMAIN\user | Supported, but not recommended for secure environments |
corp\db2admin.user@domain.com) for Kerberos authentication.
Do not use hybrid formats like:
corp.company.com\db2admin
This is not a valid authentication format. It incorrectly combines a DNS-style domain name with a NetBIOS-style backslash (\). Windows authentication APIs (including WinRM and Kerberos) do not recognize this format, and it will result in authentication failure.