PowerScale: OneFS: SPNs are reported missing when already registered

Just as KB article # 502666 states, the following changes can cause the CELOG event to trigger:

• Cluster/node reboot
• CELOG processes/services reset
• Periodic CELOG checks through the CELOG monitor

Either an alert is generated, or missing SPNs are found when running isi auth ads spn check <provider>, although an SPN already exists for the reported "missing" SPN.

Attempts to "fix" the missing SPNs may fail with an LDAP error: LW_ERROR_LDAP_CONSTRAINT_VIOLATION

Note: By default, OneFS both requires (for S4U) and will register (when joined to an AD domain) an SPN for the cluster name

CELOG alert:

• The alerts do not specify the AD provider containing the missing SPNs. It is possible if the cluster is joined to two AD domains, one of the domains may not have the SPN registered.

Missing SPNs via CLI: isi auth ads spn check <provider>:

• If a SmartConnect zone is configured as the name of the cluster, and there is a case mismatch, the SPN will report as missing

isi800-1 # isi auth ads spn check --provider-name=domain.com                                
Possible missing SPNs:
          HOST/ISI800

isi800-1 # isi network pools list -v                                               
                     ID: groupnet0.ext_sub_10.pool0
               Groupnet: groupnet0
                 Subnet: ext_sub_10
                   Name: pool0
                  Rules: -
            Access Zone: System
...
      SC Connect Policy: round_robin
                SC Zone: ISI800
...

SPNs are required for Kerberos authentication to work.

For the purpose of this KB article, the resolutions are:

1. If a CELOG alert was triggered but the SPN is already registered on at least one of the multiple AD providers, register the SPN on the other provider if absolutely necessary (duplicate SPNs registered between two trusted domains is not advised, and may result in authentication failures)
2. If missing SPNs are reported due to case sensitivity, either rename the zone to lower case, or simply ignore the alert

SPNs are case insensitive from a Windows perspective.