For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

JoeTheFifth's avatar
JoeTheFifth
Icon for Altostratus rankAltostratus
Oct 08, 2018

Grab username/domain from a kerberos ticket header

Is there a way to get the username/domain from a kerberos ticket without having a ressource (web site) server side. In other words: I have an IDP and I'm getting a saml request from an external SP. ...
application delivery
BIG-IP
BIG-IP Access Policy Manager (APM)
Kevin_Stewart's avatar
Kevin_Stewart
Icon for Employee rankEmployee
Oct 08, 2018

but I don't have any web site or ressource to do the AAA kerberos auth

 

You don't need any web site or resource to do Kerberos AAA. APM client side Kerberos is constrained to APM itself and has no reliance on backend servers. If you can properly authenticate a browser with Kerberos AAA, using a very basic 401 and Kerberos auth agent in the VPE, the username and domain will be available in the session.logon.last.username as user@REALM.