F5 is upgrading its customer support chat feature on My.F5.com. Chat support will be unavailable from 6am-10am PST on 1/20/26. Refer to K000159584 for details.

Forum Discussion

Dev_56330's avatar
Dev_56330
Icon for Cirrus rankCirrus
Jun 30, 2018

Kerberos - Requesting ticket can't get forwardable tickets (-1765328163)

Can anyone provide details into how to resolve this error? I have included screenshots of my delegation account and Kerb SSO configuration. Not quite sure how to resolve this.

 

/Common/WDMSmartCardAuth:Common:df0ae4ff:UCCmap.size = 3 2018-06-30 14:29:47

 

/Common/WDMSmartCardAuth:Common:df0ae4ff:S4U ======> - NO cached S4U2Proxy ticket for user: user@DEMO.LAB server: HTTP/webserver.demo.lab@DEMO.LAB - trying to fetch 2018-06-30 14:29:47

 

/Common/WDMSmartCardAuth:Common:df0ae4ff:S4U ======> trying to fetch S4U2Proxy ticket for user: user@DEMO.LAB server: HTTP/webserver.demo.lab@DEMO.LAB 2018-06-30 14:29:47

 

/Common/WDMSmartCardAuth:Common:df0ae4ff:Kerberos: can't get S4U2Proxy ticket for server HTTP/webserver.demo.lab@DEMO.LAB - Requesting ticket can't get forwardable tickets (-1765328163) 2018-06-30 14:29:47

 

/Common/WDMSmartCardAuth:Common:df0ae4ff: Kerberos: Failed to get ticket for User: 'user@DEMO.LAB' accessing service: 'HTTP/webserver.demo.lab@DEMO.LAB'

 

 

application delivery
BIG-IP Access Policy Manager (APM)

2 Replies

  • Dev_56330's avatar
    Dev_56330
    Icon for Cirrus rankCirrus
    Jul 01, 2018

    Modified the delegation account to use "Any Authentication Protocol" and I am now able to obtain a kerberos ticket.

     

    • boneyard's avatar
      boneyard
      Icon for MVP rankMVP
      Jul 07, 2018

      hehe, thanks for reporting back, was already predicting that when i saw the screenshot.

       

      still not enough Microsoft AD knowledge to understand why that other setting doesn't work.