Forum Discussion

Rene_Bader_1308's avatar
Rene_Bader_1308
Icon for Altostratus rankAltostratus
Dec 15, 2014

APM - show Kerberos Tickets

All,   I configured APM with a Kerberos Constrained Delegation for Kerberos SSO.   This is working so far but for debugging it would be helpfull to list all Kerberos Tickets granted.   Is t...
BIG-IP Access Policy Manager (APM)
security
TMOS
TMSH
  • Francisco_Tresg's avatar
    Francisco_Tresg
    Jan 04, 2015

    Hi René,

     

    It seems F5 stores the TGTs for Kerberos in different cache files under the "/var/run/krb5cc/*" directory. Once there, depending on your partition set, there should be a different cache file for every user account which has been "delegated".

     

    PATH for kerberos cache files: /var/run/krb5cc/"PartitionName"/"ADAuthServerName"/

     

    For example, in my lab:

     

    "[] config klist /var/run/krb5cc/Common/portal_f5_lab_aaa_srvr/krb5cc_0

     

    Ticket cache: FILE:/var/run/krb5cc/Common/portal_f5_lab_aaa_srvr/krb5cc_0

     

    Default principal: USER1@F5.LAB

     

    Valid starting Expires Service principal

     

    01/04/15 15:39:11 01/05/15 01:39:11 krbtgt/F5.LAB@F5.LAB renew until 01/05/15 15:39:11

     

    01/04/15 15:39:11 01/05/15 01:39:11 ldap/dc1.f5.lab@F5.LAB renew until 01/05/15 15:39:11

     

    [] config klist /var/run/krb5cc/Common/portal_f5_lab_aaa_srvr/krb5cc_1

     

    Ticket cache: FILE:/var/run/krb5cc/Common/portal_f5_lab_aaa_srvr/krb5cc_1

     

    Default principal: USER2@F5.LAB

     

    Valid starting Expires Service principal

     

    01/04/15 15:39:11 01/05/15 01:39:11 krbtgt/F5.LAB@F5.LAB renew until 01/05/15 15:39:11 "

     

JoeTheFifth's avatar
JoeTheFifth
Icon for Altostratus rankAltostratus
Jan 28, 2018

I'm using version 12.1.3 in my lab. I just logged to a website using kerberos sso. Klist shows: klist: No credentials cache found (ticket cache FILE:/tmp/krb5cc_0) Apm log shows: Jan 19 11:13:31 F5 debug apmd[6603]: 01490023:7: /Common/CustomPolicy:Common:8b286923: AD module: ENTER Function queryActiveDirectory Jan 19 11:13:31 F5 debug apmd[6603]: 01490111:7: /Common/CustomPolicy:Common:8b286923: AD module: verifyKrb5Cache(): Ticket cache: FILE:/var/run/apmd/krb5cc/Common/labdomain/krb5cc_0 Default principal: labuseracct@labdomain.SVC Jan 19 11:13:31 F5 debug apmd[6603]: 01490111:7: /Common/CustomPolicy:Common:8b286923: AD module: verifyKrb5Cache(): server realm:labdomain.SVC princ realm:labdomain.SVC server data[0]:krbtgt server data[1]:labdomain.SVC curr time: 1516360411 end time: 1516393613 Default principal: labuseracct@labdomain.SVC

 

I have an encrypted file in the apmd folder. How to get a list of the cached tickets?