Forum Discussion

Wand_97484's avatar
Wand_97484
Icon for Nimbostratus rankNimbostratus
Sep 13, 2013

APM ClientCert to Kerberos Transition - parsing SubjectAlternateName in Variable assign

Hi,   I'm currently setting up different APM profiles to test Kerberos Protocol Transition. LDAP Auth to Kerberos works RSA SecurID to Kerberos works Client Certificate to Kerberos - does not work...
BIG-IP Access Policy Manager (APM)
security
Kevin_Stewart's avatar
Kevin_Stewart
Icon for Employee rankEmployee
Oct 08, 2013

It looks like the Kerberos Client Principal is build by sAMAccountName@REALM

 

I think it's safer to say that Windows will accept both userPrincipalName AND sAMAccountName for identity assertion. Either can usually be in name@domain or domain\name format.