For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

eric_haupt1's avatar
eric_haupt1
Icon for Nimbostratus rankNimbostratus
Oct 04, 2018

APM KCD SSO - Requesting ticket can't get forwardable tickets (-1765328163) but works eventually

I'm running into this well known KCD SSO error. I have APM performing the necessary SSO variable definitions using LDAP queries which map certificate IDs (Domain userPrincipalName) to sAMAccountNames...
application delivery
BIG-IP Access Policy Manager (APM)
eric_haupt1's avatar
eric_haupt1
Icon for Nimbostratus rankNimbostratus
Oct 09, 2018

Kevin, So: if the realm is "internal.com" but the user hit the FQDN app1.external.com and the SPN in the @INTERNAL.COM" REALM is HTTP/app1.external.com and the F5 service account is delegated as a host/ for the service SPN

 

Then the APM SSO service account should be in @INTERNAL.COM? Because it is. The SPN defined for the external service is the only object of the KCD transaction that doesn't define the internal realm in any way.