Forum Discussion

Rene_Bader_1308's avatar
Rene_Bader_1308
Icon for Altostratus rankAltostratus
Dec 15, 2014

APM - show Kerberos Tickets

All,   I configured APM with a Kerberos Constrained Delegation for Kerberos SSO.   This is working so far but for debugging it would be helpfull to list all Kerberos Tickets granted.   Is t...
BIG-IP Access Policy Manager (APM)
security
TMOS
TMSH
  • Francisco_Tresg's avatar
    Francisco_Tresg
    Jan 04, 2015

    Hi René,

     

    It seems F5 stores the TGTs for Kerberos in different cache files under the "/var/run/krb5cc/*" directory. Once there, depending on your partition set, there should be a different cache file for every user account which has been "delegated".

     

    PATH for kerberos cache files: /var/run/krb5cc/"PartitionName"/"ADAuthServerName"/

     

    For example, in my lab:

     

    "[] config klist /var/run/krb5cc/Common/portal_f5_lab_aaa_srvr/krb5cc_0

     

    Ticket cache: FILE:/var/run/krb5cc/Common/portal_f5_lab_aaa_srvr/krb5cc_0

     

    Default principal: USER1@F5.LAB

     

    Valid starting Expires Service principal

     

    01/04/15 15:39:11 01/05/15 01:39:11 krbtgt/F5.LAB@F5.LAB renew until 01/05/15 15:39:11

     

    01/04/15 15:39:11 01/05/15 01:39:11 ldap/dc1.f5.lab@F5.LAB renew until 01/05/15 15:39:11

     

    [] config klist /var/run/krb5cc/Common/portal_f5_lab_aaa_srvr/krb5cc_1

     

    Ticket cache: FILE:/var/run/krb5cc/Common/portal_f5_lab_aaa_srvr/krb5cc_1

     

    Default principal: USER2@F5.LAB

     

    Valid starting Expires Service principal

     

    01/04/15 15:39:11 01/05/15 01:39:11 krbtgt/F5.LAB@F5.LAB renew until 01/05/15 15:39:11 "

     

Rene_Bader_1308's avatar
Rene_Bader_1308
Icon for Altostratus rankAltostratus
Dec 16, 2014

Hi Seth,

 

klist does not show any entries.

 

But I know that there are some Kerberos Tickets as the APM log shows for example

 

"Expire thread: TGTlist:1 TGTMap:2 UCClist:4 UCCmap:2"

 

Thanks

 

René