Return
-
Title
KRB5_CC_END End of credential cache reached -
Description
Any action that requires the creation of an object and the setting of a password on that object in a cross domain, child domain or cross forest scenario will fail with the error message;KRB5_CC_END (-1765328242): End of credential cache reached"this message can be seen if the vastool command is ran with the -d5 parameter (debug level 5)ERROR: Failed to create computer lab001, (VAS_ERR_KRB5: Kerberos errorKerberos errorCaused by:KRB5_CC_END (-1765328242): End of credential cache reached)ERROR: VAS_ERR_KRB5: Kerberos errorKerberos errorCaused by:KRB5_CC_END (-1765328242): End of credential cache reached -
Cause
You are running Authentication Services Software version 4.2.5 or 5.0.5 ONLY. No other versions are affected.
Example 01:Child Domain Fail - Object Creation# /opt/quest/bin/vastool -u user@domainA.com -w 'Password' create -o -c "DC=ChildDomain,DC=domainA,DC=com" computer alab103Example 02:Cross-Domain Fail - Full Join/opt/quest/bin/vastool -u USER@DOMAINA.COM -w XXXXX join DOMAINB.COMThese two examples are not exhaustive of the list of impacted scenarios but should suffice in demonstrating what to watch for. -
Resolution
Update: This issue, CR 303319, is fixed in version 5.0.6 of Safeguard Authentication Services.
Previous potential workaround:
A workaround may be to use an account from the same domain you are joining or creating the computer account and NOT use cross-domain accounts.
-
Change Request
303319 -
Additional Information
BUG 303319 has been created to address this issue.