views:

326

answers:

1

Hi all,

My question is pretty much summed up in the subject.The context is a problem we are facing with the account getting locked our fairly often. My setup uses this as the service acccount for clearcase application.

There is another account by the same name (but in a different domain - a trusted domain) that runs a monitoring sofftware under this account. For eg., my setup uses the accoundt DOMAINA/clearcase_albd, while this other trusted domain runs a batch file under TRUSTEDDOMAIN/clearcase_albd.

We are suspecting this account to be causing the locking out of our service account (but at this point have not yet figured out why!) Have pored over event logs endlessly, to no avail and have now decided to start fresh from ground zero.Am following a thread of thought and the first thing I need confirmation on is this:

Should I be seeing DOMAINA/clearcase_albd account when i run clearlicense at all? If not, then why would another account by SAME name but from a different domain lock out my domain account?

Would greatly appreciate any help in this regard,

Thanks in advance

+1  A: 

According to the IBM ClearCase Manual, the Rational® ClearCase® albd_server program runs with the identity of a special user account known as the Rational ClearCase server process user.
This user is a member of the Rational ClearCase administrators group, which grants privileged user status.

That account should not directly uses a license, as it is related to the albd (Atria Location Broker) process which will execute operation on behalf other users.

When a client program needs access to a service (a VOB or view server, for example) on a Rational ClearCase server host, it uses a remote procedure call (RPC) to send a request to the albd_server process on that host.
The albd_server starts the requested service if it is not already started, and provides the service’s port number to the client. Thereafter, the client communicates directly with the service.

IBM does suggest two albd accounts, for central VOB/view servers and end-user workstations. This is primarily done to prevent albd account issues (account lockouts, etc) on the albd account from impacting the VOB servers themselves.
BUT: those accounts should be on the same domain.


Note: by typing

creds clearcase_albd

You will see its SID for the current Windows domain.

You will then be able to check if that SID pops up in the clearlicense command output.

VonC
Thanks VonC. You have given me some very good pointers. Will try getting the second albd account for starters. But I am still baffled as to why a second clearcase_albd account from ANOTHER domain should lockout the clearcase_albd account on my domain (although they share the account name). Should they not have seperate SID's? Or am i completely off track? Thanks again for the help.
Critical Skill
@critical.skill They should indeed, but you can check that with the creds.exe command.
VonC
well - I did. The problem is the creds.exe can run for the users in the current domain only and I dont have access to any computer on the other domain (trusted) to verify the SID of the suspect. But I'll get around to it via someone or the other - thanks again.
Critical Skill