For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

MS's avatar
MS
Icon for Nimbostratus rankNimbostratus
Mar 06, 2014

Kerberos: can't get TGT for HOST/abc@abc.com - Realm not local to KDC

Hi There,   I am trying to get the Kerberos constrained delegation to work, where the client authentication is done via certficate with the BIGIP. The BIGIP uses the further via Kerberos SSO to au...
BIG-IP Access Policy Manager (APM)
deployment
security
MS's avatar
MS
Icon for Nimbostratus rankNimbostratus
Mar 07, 2014

Thanks for the helpful checklist. I have verified all settings and had to change the UPN setting as we also use it for exchange.

 

Once that was done now i get SU4 -> OK However what i got further is GSSAPI Init_sec_context returned code 0 GSSAPI token of length 4759 bytes will be sent back

 

So i have changed the send authorization to = On 401 Status code once that was done the matter even got worse

 

ssoMethod: kerberos usernameSource: session.logon.last.username userRealmSource: session.logon.last.domain Realm: ABC.COM KDC: server@abc.com AccountName: HOST/xyz@abc.com spnPatterh: HTTP/%s@abc.com TicketLifetime: 600 UseClientcert: 0 SendAuthorization: 1