Kerberos is a time-sensitive protocol. Your Unix hosts must be synchronized within five minutes of your Active Directory domain controllers. Run the following command as root to have Safeguard Authentication Services synchronize the local time with Active Directory:
vastool timesync
The most common installation or upgrade failure is that the Unix host cannot read the Safeguard Authentication Services application configuration in Active Directory. Ensure that you have followed the instructions in Configure Active Directory and that the configuration has been created successfully.
During an upgrade, you may see an error that Safeguard Authentication Services cannot upgrade because the application configuration cannot be located. If you previously joined to a specific domain controller, Safeguard Authentication Services disabled DNS SRV record lookups. This means that Safeguard Authentication Services cannot resolve other domains in the forest and may be unable to locate the application configuration. In this case, you must ensure that the domain controller you specified is a global catalog. Otherwise, you must create the Safeguard Authentication Services application configuration in the domain that you join or you must properly configure DNS to return SRV records and join normally, rather than specifying a domain controller when you join.
For more information, see About Active Directory configuration.
If you are unable to join the domain, run the preflight utility to validate your environment.
For more information, see The pre-installation diagnostic tool.
Then, verify the following:
If you are joining to a specific domain controller you must ensure that Safeguard Authentication Services can locate and read the configuration information in Active Directory. You should do one of the following:
For more information, see About Active Directory configuration.
If you are unable to log in as an Active Directory user after installing, check the following:
vastool status
Correct any errors reported by the status command, then try logging in again.
vastool user checklogin <username>
The output displays whether the user is a known Active Directory user. If not, you may need to map the user to an Active Directory account or Unix-enable the Active Directory account. If the user is known, an access control rule may prevent them from logging in. The output of the command displays which access control rules are in effect for the user.
You may need to restart window managers such as gdm in order for the window manager to reload NSS modules. Until the window manager reloads the NSS configuration, you will be unable to log in with an Active Directory user. Other services such as cron may also be affected by NSS changes. If you are unsure which services need to be reloaded, reboot the system.
Note:
If you are configuring Safeguard Authentication Services on VMwareESX Server vSphere (ESX 4.0) the reason you can not log in may be related to access control issues. See Configuring Access Control on ESX 4 in the Safeguard Authentication Services Administration Guide.
© 2024 One Identity LLC. ALL RIGHTS RESERVED. Feedback Terms of Use Privacy Cookie Preference Center
