For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

MS's avatar
MS
Icon for Nimbostratus rankNimbostratus
Mar 06, 2014

Kerberos: can't get TGT for HOST/abc@abc.com - Realm not local to KDC

Hi There,   I am trying to get the Kerberos constrained delegation to work, where the client authentication is done via certficate with the BIGIP. The BIGIP uses the further via Kerberos SSO to au...
BIG-IP Access Policy Manager (APM)
deployment
security
Kevin_Stewart's avatar
Kevin_Stewart
Icon for Employee rankEmployee
Mar 06, 2014

Totally understand that, but in many environments the username and realm, whether you're using the email address or SAN UPN, doesn't match the actual username and Active Directory domain name. In fact the only time that would probably happen is if the domain itself was issuing the certificates. So as a more concrete example, let's say the AD domain name is DOMAIN.COM. Is the value that you're pulling from the cert (email or SAN UPN) of the same realm (ie. user@domain.com)? If not, do you have an alternate UPN suffix value in the domain for that certificate user realm?