For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

ADCLearner's avatar
ADCLearner
Icon for Nimbostratus rankNimbostratus
Mar 26, 2024

502 (bad gateway) error with Kerberos SSO in "Clientless" mode when authenticating with WCF services

Currently, we are encountering a 502 (bad gateway) error with Kerberos SSO in "Clientless" mode when authenticating with WCF services. To enable the proper functioning of WCF with APM policies, we...
application delivery
security
Lucas_Thompson's avatar
Lucas_Thompson
Icon for Employee rankEmployee
Apr 03, 2024

At runtime Kerberos SSO needs to know a Realm (domain) and a UPN (username), so your clientless-mode session must be able to provide correct values into the APM session variables session.sso.token.username and session.logon.last.domain. 

To troubleshoot this, I'd just enable debug logging on SSO and session, then just compare a test from each line-by-line and see where it falls over. Kerberos S4U is somewhat complicated. We have a few articles on troubleshooting it:

https://my.f5.com/manage/s/article/K59350434

https://my.f5.com/manage/s/article/K40119818