-
标题
Authentication starts failing. Domain controller cannot be found. -
说明
Authentication for an application using AD unix enabled account fails.
The log file around the time of the failure shows the following: DATE TIME SERVER NAME vasd[9063]: directory_config_interval: Flushing caches due to detected change in schema settings vasd[9063]: directory_config_interval: Successfully flushed caches after schema change.
This issue may also result in a small but regular memory leak every second or so.
This issue occurred when the following conditions existed:
1) Cross forest domains.2) In-site cross forest domain server being marked unreachable .3) Out of site DC for cross forest domain, pick a decommissioned one. Hence the randomness. -
原因
Product Defect: 794218 - old srvinfo entries not being cleared when dnsTTL value expiredProduct Defect 794222 - schema detect failure leads to flush. If when vasd does it's schema detect, it happens to pick decommissioned servers twice in a row, it fails to find the schema. That should lead to a failure, but instead we seem to pick default values, which leads to it appearing like the schema has changed. -
解决办法
WORKAROUND:
1 - Run the following command to clear out the srvinfo and removed the DCs from the cache:
/opt/quest/bin/vastool daemon stop vasd; printf ".timeout 5000\ndelete from srvinfo;\ndelete from usn_cache;\n" | /opt/quest/libexec/vas/sqlite3 -header /var/opt/quest/vas/vasd/vas_misc.vdb; /opt/quest/bin/vastool daemon start vasd ; sleep 1; /opt/quest/bin/vastool flush
2 - Run the below commands to configure the /etc/opt/quest/vas/vas.conf and set configuration-refresh-interval to 0 to stop it:
/opt/quest/bin/vastool configure vas vasd configuration-refresh-interval 0
STATUS:
Fixed in QAS 4.1.8.RESOLUTION:Upgrade to QAS 4.1.8. You can download it by going here: https://support.oneidentity.com/authentication-services/4.1.8/download-new-releases -
变更请求
794218,794222