Forum Discussion
FastL4 VS not passing the SSO credentials properly
What application is this? And are sure you're doing Kerberos?
You should expect the server to respond with a 401, and inside the 401 "Unauthorized" response will be a header called "WWW-Authenticate" with a value of Negotiate, NTLM, Basic, or some combination of these. But what's more important is what the browser does next. You can see this in a Wireshark capture. The browser will either contact a KDC (Kerberos key distribution center) for a ticket, or respond with an NTLM challenge-response, or respond with an encoded Basic authorization header. If it is indeed Kerberos, the initial request to the KDC must include the service's servicePrincipalName (SPN). This is the SPN of the service that owns the application resources.
You need to find out what AD account is assigned to the dc01server.example.com and dc02server.example.com services, and the SPN of that account. Right now you're making a request to https://mytestapp.example.com, getting an expected 401 response from the backend servers, and the browser is trying to get a ticket for HTTP/mytestapp.example.com. If that's not correct, the browser will prompt you for login credentials.
Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com