InterScanTM Messaging Security Virtual Appliance - Online Help ...

Trend Micro InterScan Messaging Security Virtual Appliance Administrator’s Guide
32-10
TABLE 32-1. Troubleshooting issues
ISSUE DESCRIPTION AND RESOLUTION
Users are unable
to log on to the
EUQ management
console
using Kerberos
single sign-on
(SSO)
Logging on to the EUQ console using SSO requires the
following:
1. LDAP1 or LDAP2 servers are enabled and specified
as in use for Active Directory (IP address or domain
name or FQDN).
2. The DNS server configured for IMSVA contains the
record of the Kerberos service.
3. The endpoint operating system supports (and
enables) Kerberos authentication:
• Time should be synchronized between IMSVA and
the Kerberos authentication service.
• Using FireFox: The about:config link is configured to
add the negotiate-auth trusted url list.
• Using Internet Explorer: The EUQ console is added
to the internal site list.
The Windows integrated authentication setting in
Internet Explorer is enabled.
• Using Windows Vista or above, use the hostname as
the instance when generating a keytab file.
4. Only one EUQ console instance can be mapped to
one user account. If the instance is mapped to more
than one user, SSO will not work.
5. If EUQ is deployed in a parent-child deployment, use
the parent device’s 8447 port to access EUQ. SSO
will not work if a child’s port is used.
6. The account provided on the LDAP Settings screen
has permission to look up all accounts for
authentication.