7.1

Note that if an entry for a domain already exists in the le, it is not updated. For example, if you created
a directory, then deleted it, the original domain entry remains in the le and is not updated.
n
The le is not updated automatically in any other scenario. For example, if you delete a directory, the
domain entry is not deleted from the le.
n
If a domain controller listed in the le is not reachable, edit the le and remove it.
n
If you add or edit a domain entry manually, your changes will not be overwrien.
How Domain Controllers are Selected to Auto-Populate the domain_krb.properties
File
To auto-populate the domain_krb.properties le, domain controllers are selected by rst determining the
subnet on which the connector resides (based on the IP address and netmask), then using the Active
Directory conguration to identify the site of that subnet, geing the list of domain controllers for that site,
ltering the list for the appropriate domain, and picking the two domain controllers that respond the fastest.
To detect the domain controllers that are the closest, VMware Identity Manager has the following
requirements.
n
The subnet of the connector must be present in the Active Directory conguration, or a subnet must be
specied in the runtime-config.properties le.
The subnet is used to determine the site.
n
The Active Directory conguration must be site aware.
If the subnet cannot be determined or if your Active Directory conguration is not site aware, DNS Service
Location lookup is used to nd domain controllers, and the le is populated with a few domain controllers
that are reachable. Note that these domain controllers may not be at the same geographical location as the
connector, which can result in delays or timeouts while communicating with Active Directory. In this case,
edit the domain_krb.properties le manually and specify the correct domain controllers to use for each
domain.
Sample domain_krb.properties File
example.com=host1.example.com:389,host2.example.com:389
n
Override the Default Subnet Selection on page 94
To auto-populate the domain_krb.properties le, the connector aempts to nd domain controllers
that are at the same site so there is minimal latency between the connector and Active Directory.
n
Edit the domain_krb.properties le on page 95
The /usr/local/horizon/conf/domain_krb.properties le determines the domain controllers to use
for directories that have DNS Service Location lookup enabled. You can edit the le at any time to
modify the list of domain controllers for a domain, or to add or delete domain entries. Your changes
will not be overridden.
n
Troubleshooting domain_krb.properties on page 96
Use this information to troubleshoot the domain_krb.properties le.
Override the Default Subnet Selection
To auto-populate the domain_krb.properties le, the connector aempts to nd domain controllers that are
at the same site so there is minimal latency between the connector and Active Directory.
To nd the site, the connector determines the subnet on which it resides, based on its IP address and
netmask, then uses the Active Directory conguration to identify the site for that subnet. If the subnet of the
virtual machine is not in Active Directory, or if you want to override the automatic subnet selection, you can
specify a subnet in the runtime-config.properties le.
Configuring vRealize Automation
94 VMware, Inc.