Forum Discussion
Davo_T_20783
Nimbostratus
Mar 30, 2014APM SSO config using Kerberos to Weblogic backend not supplying session id cookie on post authentication requests
Hi,
We have constrained delegation and kerberos authentication working using APM 11.2.0, however once authenticated, subsequent request the JSESSIONID is not being supplied in the F5 request to ...
Davo_T_20783
Nimbostratus
Mar 30, 2014Here is the APM documentation about the "Send Authorisation" - why does F5 force OID to be 1.2.840.113554.1.2.2 for the Always option? It just doesn't make sense. What I want the APM to do is use the SPNEGO OID for the "Always" option.
"The Kerberos ticket is submitted in the HTTP Authorization header. The header value starts with the word Negotiate, followed by one space and a base64 encoded GSSIAPI token that contains the Kerberos ticket. If the request contains an Authorization header from the client browser, it is deleted. The options are defined here.•Always The Authorization header with a Kerberos ticket is inserted into every HTTP request whether or not it requires authentication; in other words, it is inserted preemptively. The Kerberos ticket GSSAPI representation uses KRB5 Kerberos 5 mechanism displays (OID 1.2.840.113554.1.2.2).
Selecting Always results in the additional overhead of generating a Kerberos token for every request. Kerberos tickets are fetched for first request only for the user and then cached for up to the configured ticket lifetime, so that subsequent requests involve local processing only.
•On 401 Status Code The BIG-IP system forwards the user's HTTP request to the web server first without inserting a new Authorization header; (any Authorization header from a browser is also deleted). If the server requests authentication by responding with a 401 status code, the BIG-IP system retries the request with the Authorization header. The Kerberos ticket GSSAPI representation uses the SPNEGO mechanism displays (OID 1.3.6.1.5.5.2).
Selecting On 401 Status Code results in an additional BIG-IP system and server request round trip when authentication is required for the request.
"
Help guide the future of your DevCentral Community!
What tools do you use to collaborate? (1min - anonymous)Recent Discussions
Related Content
DevCentral Quicklinks
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
Discover DevCentral Connects