Forum Discussion
AltostratusApp auth breaks when put behind F5
CirrusHi,
You may have several issues here :
- Invalid SPN configuration,
- Kerberos token too big (> 32 Kb),
- ...
What is the behavior observed when putting the bigip device in front of the application ?
If you start a packet capture or an HTTP trace on the browser (Burp, httpwatch, fiddler, Developer tools, ...), you may see if you get a response 401, a tcp reset, a basic fallback or some other things you may find.
APM module is required when you require to terminate Kerberos authentication on the bigip device which is not the use case you described. So APM is not required in your situation
Yann
CirrusIt looks like the user provides a Kerberos token but the backend server refuses it.
What is the kerberos configuration you have done on the Active Directory and on the IIS server to make Kerberos works ?
Did you change the DNS name or you just changed the DNS record to point to the VIP ?
What is the configuration of your Virtual Server ?
I saw that NTLM is also supported but require a OneConnect profile and NTLM profile applied on a Virtual Server to make it works through BIG-IP.
