For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

eric_haupt1's avatar
eric_haupt1
Icon for Nimbostratus rankNimbostratus
Oct 04, 2018

APM KCD SSO - Requesting ticket can't get forwardable tickets (-1765328163) but works eventually

I'm running into this well known KCD SSO error. I have APM performing the necessary SSO variable definitions using LDAP queries which map certificate IDs (Domain userPrincipalName) to sAMAccountNames...
application delivery
BIG-IP Access Policy Manager (APM)
Kevin_Stewart's avatar
Kevin_Stewart
Icon for Employee rankEmployee
Oct 08, 2018

Eric,

 

I've been staring at this for a while and this just caught my eye, "I should add that the FQDN for the service SPN is not part of the back-end domain... but this shouldn't matter I don't think". It actually does matter. The APM SSO service account MUST be in the same realm as the target service. Users don't have to be in the same realm, but these account must be.