Return
-
Title
Service creation fails when using vastool service create command -
Description
Service account creation fails with the following error:
ERROR: Service creation failed for upn oneway/example.com@other.com
VAS_ERR_FAILURE: Unspecified failure
Caused by:
VAS_ERR_LDAP: Error encountered processing ldap result for dn [CN=example-oneway,ou=Unix,dc=other,dc=com], err=0000052D: SvcErr: DSID-031A0FC0, problem 5003 (WILL_NOT_PERFORM), data 0
.
Caused by:
LDAP_UNWILLING_TO_PERFORM: No LDAP error string defined for LDAP error code: 53
-
Cause
Unable to change the service account password due to port 464 (TCP) being blocked. -
Resolution
Ensure that the server can communicate with the domain controllers using port 464 (TCP)
Check for any firewalls that may be blocking this port. -
Additional Information
Run the service create command with debug enabled: # /opt/quest/bin/vastool -d5 -uservice create Then review the output to determine if the issue is due to communication on port 464. Entry showing timeout trying to connect to a Domain controller on port 464: ----------- 2013-01-09 15:32:12 [debug] (3135) _send_and_recv_srvinfo: Connecting to dc1.other.com, fd=7, socktype=SOCK_STREAM, port=4642013-01-09 15:32:15 [debug] (3135) _send_and_recv_srvinfo: Error connecting to dc1.other.com: 110 ----------- Entry showing the service is then removed: ----------- 2013-01-09 15:38:11 [debug] (3135) libvasadmin_ldap_log: Deleting entry CN=example-oneway,ou=Unix,dc=other,dc=com ----------- See the following knowledge base article for more information on which network ports are required for Quest Authentication Services: SOL13608 - "Which network ports do the QAS Unix/Linux/MacOSX clients use?" https://support.quest.com/SolutionDetail.aspx?id=SOL13608