Problem: On AIX machines, adinfo may report that CentrifyDC mode is down.  When trying to restart CentrifyDC or the Centrify-OpenSSH service, the following error may show:


root@hostname:/opt/freeware/lib:> Could not load program /usr/share/centrifydc/sbin/sshd:
     Dependent module /usr/lib/libgssapi_krb5.a( shr.o.2.2) could not be loaded.
     Member shr.o.2.2 is not found in archive


Cause: There may be another application installed on the machine that has implemented its own kerberos libraries. Centrify will try to use these libraries and will show errors.




Solution:

Use the ldd command to find the libraries that adclient needs. Example is below, and can also be used on linux:

$ ldd /usr/sbin/adclient

$ /usr/sbin/adclient needs:
         /usr/share/centrifydc/lib64/libgnugetopt.a(libgnugetopt.so.1)
         /usr/share/centrifydc/lib64/libeda.a(libeda.so.0)
         /usr/share/centrifydc/lib64/liblrpc.a(liblrpc.so.0)
         /usr/share/centrifydc/lib64/libldap.so
         /usr/share/centrifydc/lib64/liblber.so
         /usr/share/centrifydc/lib64/libssl.so
         /usr/share/centrifydc/lib64/libcrypto.so
         /usr/lib/centrifydc/kerberos/lib64/libgssapi_krb5.a(shr.o.2.2)
         /usr/lib/centrifydc/kerberos/lib64/libkrb5.a(shr.o.3.3)
         /usr/lib/centrifydc/kerberos/lib64/libk5crypto.a(shr.o.3.1)
         /usr/lib/centrifydc/kerberos/lib64/libcom_err.a(shr.o.3.0)
         /usr/lib/libnsl.a(shr_64.o)
         /usr/share/centrifydc/lib64/libcurl.a(libcurl.so.4)
         /usr/share/centrifydc/lib64/gcclib/pthread/libstdc++.a(libstdc++.so.6)
         /usr/share/centrifydc/lib64/gcclib/pthread/libgcc_s.a(shr.o)
         /usr/lib/libpthreads.a(shr_xpg5_64.o)
         /usr/lib/libc.a(shr_64.o)
         /usr/lib/libdl.a(shr_64.o)
         /usr/lib/librtl.a(lazy42_64.o)
         /usr/lib/libs.a(shr_64.o)
         /usr/share/centrifydc/kerberos/lib64/libkrb5support.a(shr.o.0.1)
         /usr/share/centrifydc/lib64/libcrypto.a(libcrypto.so.1.0.0)
         /usr/lib/libthread.a(shr_64.o)
         /usr/lib/libtli.a(shr_64.o)
         /usr/lib/libC.a(shr3_64.o)
         /usr/lib/libC.a(shr2_64.o)
         /unix
         /usr/lib/libcrypt.a(shr_64.o)
         /usr/lib/libc.a(pse_64.o)
         /usr/lib/libC.a(shrcore_64.o)
         /usr/lib/libC.a(ansicore_64.o)


Now that the required libraries are listed, the libraries can be exported to LIBPATH. It can be checked if there are any libraries already exported by running the following command:

 $ echo $LIBPATH


Looking closely at the error message from above, the following line should indicate which library needs to be added to LIBPATH:

 "Dependent module /usr/lib/libgssapi_krb5.a( shr.o.2.2) could not be loaded."


From the above output of the ldd command, it is seen that this path is what adclient is needing:

/usr/share/centrifydc/kerberos/lib64/libgssapi_krb5.a(shr.o.2.2)


If this path is not showing when running the echo $ LIBPATH command, it can be exported using the following command. This will put the libraries that Centrify needs first in the LIBPATH. Currently another application's libraries are first.

# export LIBPATH=/usr/share/centrifydc/kerberos/lib64:/usr/share/centrifydc/lib64:$LIBPATH



Now try restarting CentrifyDC and adinfo should now show "centrifydc mode: connected." Also, restarting the Centrify-OpenSSH service should now also succeed.