Kerberos delegation and short names problem

It is somewhat unfortunate that AD SPNs would be created that way, but not the first time I've seen that. The most robust solution would definitely be to change the SPNs in the directory. It works now, but sooner or later they'll discover other issues. The second option might be to change the DNS entry. APM Kerberos SSO performs a reverse DNS lookup against the load balanced IP address to get the name of the host, then adds "http/" to the front and "@DOMAIN.COM" to the end to create the SPN string it'll use to make a Kerberos request. If the reverse DNS lookup for any given host IP address is the fully qualified domain name, then that's what the SPN will look like. Third option might be to spoof the names locally. For every pool member, create a local Hosts entry on the BIG-IP that reflects the short name. Then in the Kerberos SSO profile, under the SPN Pattern section, enter a wildcard SPN pattern:

http/%s@DOMAIN.COM

The SSO will use this value instead of performing the DNS query.