Return
-
Title
vasd daemon going into disconnected mode error VAS_ERR_CRED_NEEDED -
Description
The Authentication Services vasd daemon goes into disconnected mode and then will not reconnecct unless the daemon is restarted. The following message is seen in the syslog messages:
parent_loop_body: Network state going down due to unable to establich creds, error <VAS_ERR_CRED_NEEDED: Encountered VAS_ID_FLAG_KEEP_COPY_OF_CRED that does not have copy of credentials
-
Cause
CAUSE1: Ports blocked
CAUSE2: This is due to a code change in Windows 2008 domain controllers around replication of computer account passwords changes.
Product Defect 319479 which has be seen 4.0.3.184 and 4.0.3.222 versions.
* vasd: After password change vasd could fail into disconnected mode with
VAS_ERR_CRED_NEEDED and need to be restarted.
What happens in the code:1) vasd notices that its been 30 days since last password change.2) Communicates with AD over port 464 ( kpasswd ) and gets a successful response. ( Password changed. )3) Communicates with AD over port 88 for a TGS for its own service to get kvno. ( I don't know if it uses old or new password here. )4) Writes out to disk the new password and kvno into a keytab.5) Writes out the 'Success' message to syslog.6) vasd dumps its current cred cache, re-loads from the new keytab.7) vasd communicates with AD over port 88 to establish its credentials ( TGT request ) and gets the response PREAUTH_FAILED.8) vasd drops its cred cache due to that, and is now in a broken state.9) In the fixed code if it is disconnected it now checks for a cred cache, and if its missing, re-loads it. Which is 30 seconds later, and it all works this time.this is due to a code change in Windows 2008 domain controllers. -
Resolution
RESOLUTION 1:Open firewall ports to allow communication Port 464 and port 88 outgoing from Authentication Services Clients to Active DirectoryRESOLUTION 2:For cause to upgrade to the latest release https://support.oneidentity.com/authentication-services/download-new-releasesWORKAROUND 1:1 - Stop the password change on the computer object from occurring:/opt/quest/bin/vastool configure vas vasd password-change-interval 02 - Restart vasdWORKAROUND 2:1 - When the password is changed, a script can be run ( password-change-script ) that just sleeps for a minute, so the password can be intra-site replicated, so whatever DC vasd talks to when it re-initializes it should have.
STATUS:Prodcut Defect in Cause 2 fixed in Authentication Services 4.0.3.225 and up
-
Change Request
319479 -
Additional Information
The solution involves performing password resets against a PDC directly. To revert to the previous method simply create the following file with touch; # touch /var/opt/quest/vas/.vasd_host_password_disable_force_pdc