SPS domain join status may incorrectly show as unjoined due to Kerberos keytab refresh failure (4384351)

On One Identity Safeguard for Privileged Sessions (SPS), the appliance may appear as not joined to the Active Directory domain even though the domain membership itself remains valid. When the issue occurs, SPS reports that the appliance is not joined to the domain, and administrators may observe Kerberos keytab related errors. The following symptoms may be present:

• The SPS web interface displays "Current domain is not joined"
• The keytab-create.service fails during the scheduled keytab refresh process
• Kerberos authentication errors such as "Preauthentication failed" are recorded in the logs
• Domain validation checks may still report successful results, including: net ads testjoin
• Winbind communication checks
• Domain controller connectivity checks

This issue is caused by a defect in the SPS domain join/keytab refresh process.

STATUS 

Change Request #492318 has been created to address this issue in a future release of SPS, subject to successful QA testing and product management approval.