here is a situation i think interesting to describe clearly :

-> Error message on a BM server during a C2S attempt :

javax.naming.NamingException [Root exception is
com.novell.service.jncp.ServerRequesterException: ccode = 35088
(0x8910)]; remaining name 'BAAN_FW1.VPN Rules.WARNER_FW1.INTERNET1'
ACLCHECK.NLM: lookupUsergroup: ReadUsergroup returns: error = -626
ACLCHECK.NLM: lookupUsergroup: ReadUsergroup returns: error = -626

-> On the client side you have a -626 error, credential, etc.. error
when using the SKIP mode, and a NMAS error when using NMAS...

-> Explanations :

the user "User.Org" for which the authentication failed is member of an
Organization not reachable by the concerned BM server at the time of the

so the BM server reads the rule BAAN_FW1, find inside the user
"User.Org", authorized to use the service, and try to find the
credentials inside the user object. If for any reason one of the replica
of the partition containing the user is not reachable immediately you
have this error