Enterprise Vault™ Discovery Accelerator Administrator's Guide
- Introducing Discovery Accelerator
- Introducing the Discovery Accelerator client
- Setting up and assigning roles
- Working with cases
- Setting up review marks and tags
- Using rules to mark and tag items automatically
- Using Custodian Manager
- Searching for items
- About searching with Discovery Accelerator
- Defining email targets with Address Manager
- Building Discovery Accelerator search schedules
- Manually reviewing items
- About reviewing with Discovery Accelerator
- Searching within the review set
- Deleting items from Enterprise Vault archives
- Working with research folders
- Exporting and producing items
- About exporting and producing items
- Performing an export or production run
- Creating and viewing reports
- Appendix A. Customizing Discovery Accelerator
- Setting Discovery Accelerator system configuration options
- Appendix B. Importing configuration data from an XML file
- Appendix C. Enterprise Vault properties for use in Discovery Accelerator searches
- Appendix D. Troubleshooting
- Issues with Custodian Manager
- Issues with Discovery Accelerator reports
Error messages when the Intelligent Review (IR) API authentication and authorization fails
This is a Kerberos double hop error. This error appears if the Kerberos constrained trusted delegation is not set correctly between the Compliance Accelerator Server and the Compliance Accelerator Database Server.
To fix this error, perform the following steps:
Verify if the Compliance Accelerator Server is trusted for delegation.
Check if the installation setup/environment has Kerberos constrained trusted delegation is set properly. Verify the SQL Service Service Principal Names (SPNs) for correctness, duplication, and missing SPNs. Use the Kerberos Configuration Manager tool.
Verify if the Compliance Accelerator Server is using Fully Qualified Domain Name (FQDN) and not IP Addresses for connecting to the Compliance Accelerator Configuration and the customer databases. For configuration database, verify if the <install dir \Veritas Intelligent Review\IR.APIEndPoint \appsettings.json-> ConfigDBConnection key is using the FQDN and not IPAddress for connection string. For the customer database, verify if the configuration database->tblCustomer table for the 'Server' field for that customer is using FQDN and not IPAddress.
Verify if the SQL Server service account is a user, then that user is trusted for delegation, and various properties like the user is allowed for the delegation are set correctly.
Refer to the sample screen below.
To fix this issue, perform the following procedure:
- Create the correct SPNs. For example, If the SQL Service is running as a Vault Service account (VSA) user, create or check if proper SPNs exist for VSA.
- Create SPNs for the availability group listener as well as the actual SQL nodes.
- Enable the Compliance Accelerator Server to trust for delegation (only the listener). Refer to the sample image below.
Note:
Choose Add… while trusting for delegation and choose the SQL Service account (VSA) on which the SPNs are configured.
- Restart the Active Directory Domain service on the Domain Controller.
- Restart Internet Information Services (IIS) on the Compliance Accelerator Server.
- Call the Intelligent Review (IR) API directly or via Enterprise Vault. Refer to the sample image below.