Cannot login with users setup as permanent disconnected users, when VAS is unable to communicate (4301699)

Users setup as permanent disconnected users, cannot login when VAS is unable to communicate with Active Directory (AD). Which is contrary to what the pam_vas man page states: " [that] for persistent disconnected authentication, Administrators can configure a set of users who will use the persistent disconnected auth mode instead of the password hash mode. This is done with the perm-disconnected-users option in the [vas_auth] section in /etc/opt/quest/vas/vas.conf.

Persistent disconnected authentication relies on the ability to request service tickets for user accounts. When AD is running in Windows 2003 Native Mode, or higher, this is not possible unless the user accounts have the ServicePrincipalName attribute set.

To use persistent disconnected authentication with Windows 2003 Native Mode and higher, administrators must set the "servicePrincipalName" attribute on the users using this form of disconnected authentication. This can be done with the vastool setattrs command, as follows:

# vastool -u admin setattrs jdoe servicePrincipalName vas/jdoe@example.com

This step will allow the user to use persistent disconnected authentication. From the windows side, this can be done using the ADSI Edit utility, or with simple scripts that use the ADSI API's.