F5 is upgrading its customer support chat feature on My.F5.com. Chat support will be unavailable from 6am-10am PST on 1/20/26. Refer to K000159584 for details.

Forum Discussion

JoeTheFifth's avatar
JoeTheFifth
Icon for Altostratus rankAltostratus
Oct 08, 2018

Grab username/domain from a kerberos ticket header

Is there a way to get the username/domain from a kerberos ticket without having a ressource (web site) server side. In other words: I have an IDP and I'm getting a saml request from an external SP. ...
application delivery
BIG-IP
BIG-IP Access Policy Manager (APM)
Kevin_Stewart's avatar
Kevin_Stewart
Icon for Employee rankEmployee
Oct 08, 2018

but I don't have any web site or ressource to do the AAA kerberos auth

 

You don't need any web site or resource to do Kerberos AAA. APM client side Kerberos is constrained to APM itself and has no reliance on backend servers. If you can properly authenticate a browser with Kerberos AAA, using a very basic 401 and Kerberos auth agent in the VPE, the username and domain will be available in the session.logon.last.username as user@REALM.