Forum Discussion

Daniel_W__13795's avatar
Daniel_W__13795
Icon for Nimbostratus rankNimbostratus
Jan 15, 2016

Kerberos 401 authentication with form fallback

Hello,   we are using APM for SAML authentication. Domain joined machines should authenticate transparently with Kerberos, users without the ability to use Kerberos (non domain joined, Firefox wit...
BIG-IP Access Policy Manager (APM)
kerberos
security
SSO
Kevin_Stewart's avatar
Kevin_Stewart
Icon for Employee rankEmployee
Jan 28, 2021

It’s actually not that simple, and not really an APM issue. The problem is that there’s no event to fire on. When the client (browser) receives the 401, it has to do something. It’ll either try to satisfy the negotiate request, or fail. And if it fails, it doesn’t send anything back to the server, hence nothing for the server (APM) to trigger on.

 

The prescribed workarounds usually involve making sure the client *can* authenticate, often by making sure they’re on the right network (by source IP).

  • bradhanson's avatar
    bradhanson
    Icon for Altocumulus rankAltocumulus
    Jan 28, 2021

    So you are indicating that the message ""Authentication required to access the resources." is being issued by the browser and not by the APM?

    I can't see anything on some quick searches that indicate any such message other than brining up some references to F5 APM.

     

    I can do a trace.. I tried the procedure outlined 5 years ago. it doesn't work. If i set to negotiate+basic it follows the basic path, if i set to negotiate it returns "Authentication required to access the resources.".

     

    So if it is the browser that is stuck and stops, perhaps firefox or edge would work differently? THanks for your quick response Kevin, much appreciated.