Forum Discussion
elfasso_137228
Nimbostratus
NimbostratusKerberos SSO without APM?
Hi,
I have a question regarding Single Sign-On with kerberos.
I have a pair of Virtual BigIPs on a Viprion-System running in Active/Standby. The systems are connected one-armed and therefor using SNAT. I am loadbalancing several servers using the LTM...quite easy, no problems.
Now the application guys would like to use our active directory for a single sign-on to these servers. This works fine, if you address one of the pool-servers directly, but not if you use the virtual server.
I think the problem is the SNAT. When crossing the LTM, the source address of the packet is changed. When the kerberos-ticket arrives at the server, the IP inside the ticket is different from the source ip because of SNAT.
Is that right, or is there another reason?
Would running the LTM in two-armed-mode without SNAT solve my problem?
Or is the only way to buy an APM license and let the BigIP talk to the active directory?
Unfortunately I have only little knowledge in SSO/Kerberos/AD, but I hope I could make myself clear.
Thanks in advance
Regards,
Thorsten
This has nothing to do with F5, but rather with the way Kerberos works. Here is an example of a great old article that talks about how to resolve this issue: http://blogs.technet.com/b/askds/archive/2011/08/09/kerberos-and-load-balancing.aspx
Arnaud_LemaireEmployee
Hello Thorsten, this should be working, when passing through the big-ip do you have a different FQDN ? when you try with one membre only in the pool is this working ? ultimetly it could be interresting to start looking at the client side information, with a browser tool to see user's requests/response.
Michael_Koyfma1Cirrus
This has nothing to do with F5, but rather with the way Kerberos works. Here is an example of a great old article that talks about how to resolve this issue: http://blogs.technet.com/b/askds/archive/2011/08/09/kerberos-and-load-balancing.aspx
- elfasso_137228Hi Michael, thanks for the very useful link. I could not try the suggestion in the link yet, but it sounds very promising. Thorsten
Michael_KoyfmanCirrocumulus
This has nothing to do with F5, but rather with the way Kerberos works. Here is an example of a great old article that talks about how to resolve this issue: http://blogs.technet.com/b/askds/archive/2011/08/09/kerberos-and-load-balancing.aspx
- elfasso_137228Hi Michael, thanks for the very useful link. I could not try the suggestion in the link yet, but it sounds very promising. Thorsten