How current are the passwords for permanent disconnected users (4289524)

1. Users are setup in vas.conf as "permanent disconnect users".

How current is the password when QAS is connected or disconnected, especially for users that have never logged in to the machine before? If I changed the "permanent disconnected users" setting in vas.conf how soon will the list be updated?

2. Is there a way to verify which accounts have been cached?

1. To determine how current the password is when connected or disconnected and how soon the list will be updated the man page for vas.conf states:

perm-disconnected-update = <integer (minutes)>
Default value: 1440

When using persistent disconnected authentication vasd will periodically check the configured list of users who can use persistent disconnected authentication to see if their cached credentials need to be updated. For example, if they have changed their password since the last time vasd updated the persistent disconnected authentication cache, vasd will obtain a new Kerberos service ticket for the user. See the perm-disconnected-users option for the [vas_auth] vas.conf section for more information on persistent disconnected authentication. This check is done every 24 hours by default. This option value represents the number of minutes used as the check interval. The following example shows how to configure vasd to check every 2 days for updates.

NOTE: This value is read once during vasd start-up. Any changes to this value require you to restart vasd before changes take effect.

[vasd]
perm-disconnected-update = 2880

2. To get the list of users, you would use the command below to be able to view the tickets of users:

# /opt/quest/bin/vastool klist -c /var/opt/quest/vas/authcache/.krb5cc_auth_ust

To manually update it, run the following:

# /opt/quest/libexec/vas/vasd/vasdis_helper -f

In detail, this is how it works with perm disconnected auth:

VAS does perm-disconnected auth by treating the user account as a service account, and aquiring a service ticket ( credential ) for that account. Then the password can be used in a disconnected situation to try and decrypt the credential. These tickets are all gathered the first time by the /opt/quest/libexec/vas/vasd/vasdis_helper binary, along with the users pwdlastset. After they are stored, for updates the pwdLastSet of the individual users are checked, and a new ticket only downloaded when the password is changed. The tickets can be viewed with:

# /opt/quest/bin/vastool klist -c /var/opt/quest/vas/authcache/.krb5cc_auth_ust

The update can be run manually with:

# /opt/quest/libexec/vas/vasd/vasdis_helper -f

The most common issue is some versions of Windows ( domain functional level ), require that the user have a servicePrincipalName value set in order to give out a serivce ticket for them. Anything can be set, <name>/vas will work, a/b will as well, but since it's an indexed value it's better to make it unique.

For more details regarding permanent disconnect users, refer to the following solutions:
SOL16090 - "Can VAS permenant disconnected users (perm-disconnected-users), who have never logged on to the server which is in workstation mode, still login when VAS is in disconnected mode? "
https://support.quest.com/SUPPORT/index?page=solution&id=SOL16090

SOL22282 - "Cannot login with users setup as permanent disconnected users, when VAS is unable to communicate with Active Directory "
https://support.quest.com/SUPPORT/index?page=solution&id=SOL22282

SOL16457 - "Users cannot logon when VAS is unable to contact a Domain Controller, and as a result, switches to disconnected mode. "
https://support.quest.com/SUPPORT/index?page=solution&id=SOL16457

SOL31934 - "VAS stays in "Disconnected Mode" "
https://support.quest.com/SUPPORT/index?page=solution&id=SOL31934

SOL30804 - "When does vasd go into disconnected mode? "
https://support.quest.com/SUPPORT/index?page=solution&id=SOL30804

SOL28696 - "VAS host entering disconnected state "
https://support.quest.com/SUPPORT/index?page=solution&id=SOL28696