Views:

The issue occurs because there is more than one Service (SRV) record of an LDAP server.

During Kerberos authentication, IMSVA queries DNS to identify the Server Principal Name of the LDAP server. Because two records are returned, IMSVA does not know which one is correct and just uses the first one, SERVER-X.some.domain.com, when requesting a ticket for the LDAP service. Thus, IMSVA is granted a ticket for SERVER-X, when it actually needs to connect to SERVER-A.some.domain.com.

To resolve the issue:

  1. Add the following into /opt/trend/imss/config/imss.ini:

    [LDAP-Setting]
    server-spn=SERVER-A@some.domain.com

  2. Restart the console by running the following command:

    /opt/trend/imss/script/S99ADMINUI restart

  3. Configure the LDAP again.