For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

MS's avatar
MS
Icon for Nimbostratus rankNimbostratus
Mar 06, 2014

Kerberos: can't get TGT for HOST/abc@abc.com - Realm not local to KDC

Hi There,   I am trying to get the Kerberos constrained delegation to work, where the client authentication is done via certficate with the BIGIP. The BIGIP uses the further via Kerberos SSO to au...
BIG-IP Access Policy Manager (APM)
deployment
security
MS's avatar
MS
Icon for Nimbostratus rankNimbostratus
Mar 07, 2014

here is the debug for the GSSAPI

 

adding item to WorkQueue

 

sid: ctx:0x8d1b978 server address = ::ffff:10.10.10.10

 

sid: ctx:0x8d1b978 SPN = HTTP/portal.abc.com@ABC:COM

 

Kerberos: realm for user someone is not set, using server's realm ABC.COM

 

S4U ======> ctx: , sid: 0x8d1b978, user: someone@ABC.COM, SPN: HTTP/portal.abc.com@ABC:COM

 

metadata len 409

 

Could not find SSO domain, check variable assign agent setting

 

Websso Kerberos authentication for user 'someone' using config '/Common/kerberos:sso_401'

 

adding item to WorkQueue

 

Kevin_Stewart's avatar
Kevin_Stewart
Icon for Employee rankEmployee
Mar 07, 2014
Did you set Authorization back to Always?