Return
-
Title
How to configure the SPN for permanent-disconnected authentication mode -
Description
There are situations where a Unix system administrator may be responsible for a large number of Unix systems. In the default mode, you need to log in to every Unix system at least once to be able to log in to the systems in a disconnected state. In a large environment with hundreds or thousands of Unix systems, this requirement would be impractical.
Safeguard Authentication Services has added a feature called Permanent-disconnected authentication mode. This mode does not require a previously successful authentication, that is, users or group of users can log into a Unix system in a disconnected state even if they had never logged into the Unix system in the past.
-
Resolution
Before you configure the permanent-disconnected authentication mode in the vas.conf file, you must first set the service principal name (SPN) for each user who will authenticate using this mode.You can set the SPN by using a tool like the Microsoft Active Directory Service Interfaces Editor (ADSI Edit) or by issuing a vastool command such as the following:vastool setattrs - u servicePrincipalName "user/@"or (preferred)vastool -u admin setattrs jdoe servicePrincipalName vas/jdoeNote: The content of the Service Principal Name is unimportant; it just needs to conform to the format of ServicePrincipalName. And it is unimportant, because we use the implicit SPN any account gets, which is SAM$@REALM. Anything can be set, /vas will work, a/b will as well, but since it's an indexed value, it is better to make it unique.As reference:sysadm@labvm01:~$ v kinit aduser01Password for aduser01@MYDOMAIN.COM:sysadm@labvm01:~$ v kinit -S host/sysadm@labvm01:~$ v klistCredentials cache: FILE:/tmp/krb5cc_10741Principal: aduser01@MYDOMAIN.COMIssued Expires PrincipalApr 8 17:49:40 2022 Apr 9 03:49:40 2022 krbtgt/MYDOMAIN.COM@MYDOMAIN.COMApr 8 17:49:48 2022 Apr 9 03:49:40 2022 sysadm_42$@MYDOMAIN.COMsysadm@labvm01:~$