Authentication Services 4.2 - Administration Guide

One Identity Privileged Access Suite for Unix Introducing One Identity Authentication Services Unix administration and configuration Identity management Migrating from NIS Managing access control Managing local file permissions Certificate Autoenrollment Integrating with other applications Managing Unix hosts with Group Policy
Authentication Services Group Policy
Group Policy Concepts Unix policies One Identity policies
Display specifiers Troubleshooting

Time synchronization problems

Kerberos is a time-sensitive protocol. Your Unix hosts must be synchronized within five minutes of your Active Directory domain controllers. Run the following command as root to have Authentication Services synchronize the local time with Active Directory:

vastool timesync 

Unable to authenticate to Active Directory

If Authentication Services can no longer authenticate with Active Directory, the following solutions may help you troubleshooting the issue.

Table 31: Troubleshooting authentication problems
Problem Solution
The host's computer object has been deleted. Recreate the computer object, then restart vasd.
The host keytab is deleted or becomes corrupt. Delete then recreate the computer object and restart vasd.

Unable to install or upgrade

The most common installation or upgrade failure is that the Unix host cannot read the Authentication Services application configuration in Active Directory. Ensure that you have followed the instructions in the Configure Active Directory for Authentication Services section of the Authentication Services Installation Guide and that the configuration has been created successfully.

During an upgrade, you may see an error that Authentication Services cannot upgrade because the application configuration cannot be located. If you previously joined to a specific domain controller, Authentication Services disabled DNS SRV record lookups. This means that Authentication Services cannot resolve other domains in the forest and may be unable to locate the application configuration. In this case, you must ensure that the domain controller you specified is a global catalog. Otherwise, you must create the Authentication Services application configuration in the domain that you join or you must properly configure DNS to return SRV records and join normally, rather than specifying a domain controller when you join.

For more information, see the About Active Directory Configuration section in the Authentication Services Installation Guide.

Unable to join the domain

If you are unable to join the domain, run the preflight utility to validate your environment.

For more information, see The Authentication Services Pre-Installation Diagnostic Tool in the Authentication Services Installation Guide .

Then, verify the following:

  • Check that the Active Directory account specified during join has rights to join the computer to the domain.
  • Check that the Unix host is able to properly resolve the domain name through DNS.

If you are joining to a specific domain controller you must ensure that Authentication Services can locate and read the configuration information in Active Directory. You should do one of the following:

  • Make sure the domain controller you specify is a global catalog.
  • Create the Authentication Services application configuration in the domain to which you are joining.

    For more information, see the About Active Directory Configuration section in the Authentication Services Installation Guide.

  • Properly configure DNS to return srv-records and avoid joining to a specific domain controller.
Documents connexes