In the `connector.log` file of a VMware Identity Manager environment, continuous LDAP communication errors are observed.

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

• Log entries indicating failure to reach specific domain controllers.
• Error message: `ERROR (pool-####-thread-5) [;;;] com.vmware.horizon.directory.ldap.dc.commons.LdapPingChecker - Communication Error connecting to dc`.
• Delays in directory synchronization or authentication timing out.

Environment

VMware Identity Manager 3.3.7

Cause

The domain controllers configured in the environment have been deprecated, decommissioned, or are otherwise no longer accessible. The `LdapPingChecker` service continues to attempt communication with these stale FQDNs, leading to connection timeouts.

Resolution

To resolve this issue, remove the stale or deprecated domain controllers from the configuration file on the appliance.

1. Take a snapshot of the VMware Identity Manager appliance.
2. Access the VMware Identity Manager appliance via SSH as the root user.
3. Open the following configuration file for modification:
   /usr/local/horizon/conf/domain_krb.properties
4. Locate and remove the entries corresponding to the deprecated domain controllers (e.g., hostnames that are no longer in service).
5. Save and close the file.
6. Restart the horizon-workspace service for the changes to take effect:
   /etc/init.d/horizon-workspace restart

Removing these entries prevents the application from routing LDAP pings to inactive servers, resolving the communication errors.