Forum Discussion

CX_280703's avatar
CX_280703
Icon for Nimbostratus rankNimbostratus
May 07, 2017

Invalid Session ID. Your session may have expired - during kerberos auth

I have an IdP setup that is doing client side kerberos auth before then sending on a SAML token to an SP. I have an intermittant issue were sometimes using the kerberos auth It seems to fail and send...
BIG-IP Access Policy Manager (APM)
idp
kerberos
saml
security
CX_280703's avatar
CX_280703
Icon for Nimbostratus rankNimbostratus
Oct 01, 2017

Actually the step above didn't help with the situation. We still see the issue. We also have an NTLM irule looks to be causing the issue. When doing an ECA::Disable for non NTLM requests it seems to intermittently break kerberos!

 

Also if I set "modify /sys db apm.rotatesessionid value disable" it seems to fix the issue but I don't want to do this as it weakens security.

 

Anyone have anything to try?