APM Policy scope/SSO Configuration

Back on track here after the devcentral migration. Like others I'm having a hard time finding content with all the 404 search errors.

Well, I have an APM policy I imported on two virtual servers.

I'm using the same cookie domain *.cookiedomain.com so I configured the APM profiles to use multiple authentication domains and set the domains to the different host names of my web sites.

I created two separate Kerberos configurations.

Let's say I have:

VS 10.0.0.1

APM Policy: Site1APMPolicy

site1: https://site1.cookiedomain.com

Kerb SSO: Site1KerbSSO

VS 10.0.0.2

APM Policy: Site2APMPolicy

site2 https://site2.cookiedomain.com

Kerb SSO: Site2KerbSSO

using the same user:

If I access site1.cookiedomain.com FIRST the SSO works Fine

If I access site2.cookiedomain.com SECOND the SSO to site2 does not work. Error message is

If I restart the rba and websso daemons and clear my browser cookies then retry like this:

site2.cookiedomain.com FIRST the SSO works Fine

If I access site1.cookiedomain.com SECOND the SSO to site1 does not work. Error message is

S4U ======> - NO cached S4U2Proxy ticket for user: user@DOMAIN.COM server: HTTP/site2.cookiedomain.com@COMMUN01.SVC - trying to fetch

S4U ======> - NO cached S4U2Self ticket for user: user@DOMAIN.COM - trying to fetch

Kerberos: can't get S4U2Self ticket for user user@DOMAIN.COM - Matching credential not found (-1765328243)

Kerberos: Failed to get ticket for user user@DOMAIN.COM

failure occurred when processing the work item

If I use the same kerberos SSO configuration for both APM policies both sites2 work fine.

The reason I'm using this setup is I have two web server farms using the same AD domain and the same cookie domain.

If I use two SSO configs with separate service accounts for APM access with the same user does not work for the second site on the second farm.

I've tried playing with the profile scope by setting the three different options but still get the same result.

The only working scenario is using the same kerberso sso configuration for both APM policy profiles.

The goal of this setup is to be able to isolate both VS and APM policy configuration.

APM Policy profiles are using different resources (different AAA Pool names and TrustedDomain configuration) even if I'm using the same AD servers behind.

Anyone to shed any lights on this?