APM, Kerberos and SSO

websso is a separate log setting. There are sort of two SSOs in APM: ssov1 and v2. v1 is used in Forms (server-initiated), HTTP (basic, ntlmv1,ntlmv2). ssov2 is used in saml, kerberos, and Forms (client-initiated). In v12, APM switched to a completely different log mechanism for the *main* logs but not the SSO logs. It's kind of confusing, but documented in the APM Operations Guide v12 (make sure you check the newest version of it) and other places. Logs are set in the SSO object itself for some types, and in System => Logs => Options for other types. In later versions (12.1+), the SSO logs will be completely controlled in the SSO object itself for all types.