Safeguard Authentication Services 4.1.5 - Management Console for Unix Administration Guide

Unable to Configure Active Directory

You specify the Active Directory configuration (that is, the set of domains, sites, and servers that you want the mangement console to contact) from System Settings | Active Directory | Advanced Settings. To access the Advanced Settings dialog, you must provide Active Directory credentials; then, once the console verifies the configuration, it saves the settings to the database.

There may be an occasion when the Active Directory configuration becomes invalid. Perhaps you set the AD configuration to specifically restrict login to a specific domain. Then later, you receive a network error saying the Active Directory credentials you provided to perform an action have been revoked because that domain no longer exists. If the Active Directory configuration becomes invalid for any reason, you will not be able to access the Advanced Setting dialog to change the AD configuration.

This topic explains how to temporarily set the ad.config.domain or ad.config.site system properties in the custom.cfg file to specify a temporary configuration to use until you can reset the AD configuration from System Settings | Active Directory | Advanced Settings.

• ad.config.domain system property contains the name of a single Active Directory domain. When specified, the mangement console will only contact Active Directory servers in this domain.

  Note: Do not configure the console for a domain outside of the current forest.

• ad.config.site system property contains the name of a single Active Directory site. When specified, the mangement console will only contact Active Directory servers in this site.

To reset Active Directory domain or site settings

1. Stop the Management Console for Unix service.

   (See Start/Stop/Restart Management Console for Unix Service for details.)

2. Locate the custom.cfg file.

   (See Setting Custom Configuration Settings for more information about customizing configuration settings for the mangement console.)

3. Add one of the following properties:

   -Dad.config.domain=<domain>

   -OR-

   -Dad.config.site=<site>

   Note: Only specify the ad.config.domain or the ad.config.site system property. If you specify both, the console will ignore the ad.system.domain setting.

4. Save the custom.cfg file.
5. Restart the Management Console for Unix service.
6. Navigate to System Settings | Active Directory | Advanced Settings to specify which sites, domains, domain controllers, or global catalogs you want the console to contact.

   (See Advanced Settings for details.)

7. Stop the Management Console for Unix service.
8. Locate the custom.cfg file.
9. Remove the temporary properties you added in Step #3. Either:

   ad.config.domain=<domain>

   -OR-

   ad.config.site=<site>

10. Save the custom.cfg file.
11. Restart the Management Console for Unix service.

Active Directory is Disabled

Kerberos is a time-sensitive protocol and requires that the clocks on the Management Console for Unix server and your Active Directory domain controllers are synchronized within five minutes. If the Management Console for Unix server gets out of sync with the Active Directory domain controller, Active Directory will be disabled temporarily and you will be instructed to check your Active Directory settings.

During the post install process, if you see an error such as 'Can't find domain controller for <domain>', verify that the Management Console for Unix server and Active Directory domain controller clocks are synchronized.

Active Directory Tasks Are Disabled

If you are logged on as an Active Directory account in the Manage Hosts role and the host is joined to Active Directory, but are not able to perform the Active Directory tasks, ensure that you have sufficient permission in Active Directory to perform the task.

Auditing and Compliance

Each action performed by the mangement console on a remote host is logged to the local syslog file. The syslog messages show you who performed the action, when, and the output (standard error, standard out).

Syslog reports any action that changes on the host, for example:

• Add, delete, modify user or group account information
• Add user to (or remove user from) users.allow
• Configure Privilege Manager policy server
• Enable (or disable) Auto Profile, SSH Key login, Auto Authentication Services agent status
• Install software
• Join to (or unjoin from) Active Directory or Privilege Manager policy group
• Map user to (or unmap user from) Active Directory