Forum Discussion

cgallimore_1748's avatar
cgallimore_1748
Icon for Nimbostratus rankNimbostratus
Mar 28, 2016
Solved

F5 APM seems to be choosing NTLM over Kerberos - cache issue?

Hello DevCentral, the scenario here is that we previously setup an application to perform NTLMv2 SSO and now have a need to perform Kerberos. When we changed the Portal Access resource to us...
application delivery
BIG-IP Access Policy Manager (APM)
SSO
  • Lucas_Thompson_'s avatar
    Lucas_Thompson_
    Mar 28, 2016

    No, there's not any cache that works that way in APM.

     

    You've probably forgotten to include resource-items in your Portal Access List or the items don't match the actual items being requested. APM doesn't necessarily know all of the URLs/hosts/ports/schemes that are included as part of your web app. So the resource-items are the way to define it if you want it to switch between SSOs for you.

     

    It could also be that your resource-items overlap with another Portal Access List.

     

Lucas_Thompson_'s avatar
Lucas_Thompson_
Historic F5 Account
Mar 28, 2016

No, there's not any cache that works that way in APM.

 

You've probably forgotten to include resource-items in your Portal Access List or the items don't match the actual items being requested. APM doesn't necessarily know all of the URLs/hosts/ports/schemes that are included as part of your web app. So the resource-items are the way to define it if you want it to switch between SSOs for you.

 

It could also be that your resource-items overlap with another Portal Access List.

 

cgallimore_1748's avatar
cgallimore_1748
Icon for Nimbostratus rankNimbostratus
Mar 28, 2016
Thank you for the quick response. I double checked the resource items, as we do have a couple that overlap but they all have Kerberos as their SSO Configuration. I also moved the portal access item in question to the 2nd ACL spot and the logs still seem to indicate that it is not trying Kerberos. Would you have any suggestions on what to look at next?