Master Data services SQL 2008 to SQL 2019 - post upgrade issue Users function tab access denied

Question

After moving and upgrading MDS from SQL 2008 to SQL 2019 I upgraded the MDS db and most things seem to work fine except for the Edit Users section. When I click on a user and then edit that user and then click the Functions tab I get an Access is Denied error

I am able to edit Group functions fine.

I can edit/view all other tabs fine (General, Membership,Models, Hierarchy Members)

the IIS logs are spitting out a 302 error (if that helps)

Answer 1

I figured this out.. MDS app when trying to open the functions tab tries to make a privileged call to SQL using Kerberos to call from the app server to the SQL server. If RC4 encryption is disabled in your domain you need to enable a higher encryption level for your service account for kerberos to work otherwise the service account won't be able to negotiate suitable level encryption for Kerberos. Enabling AES 128 and AES 256 for Kerberos on the app to SQL service account in AD resolves the issue and allows the functions tab to work.