For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

ASG_Admin_36600's avatar
ASG_Admin_36600
Icon for Nimbostratus rankNimbostratus
Jul 05, 2018

MAC book user issue with SSO Kerberos

We have a web server with SSO Kerberos configured. Windows client can easily brows then web site and SSO works fine, however, MAC book and IPad user receives HTTP 401. I'd like to create a iRules to...
BIG-IP
devops
iRules
Al_7443's avatar
Al_7443
Icon for Nimbostratus rankNimbostratus
Jul 05, 2018

Perhaps consider using the APM module to present a form-based logon to your clients that fail Kerberos. APM will use delegation to go and get a Kerbers ticket for your users, and proxy them onto the protected app. This way you still get AAA without compromising your security.

 

This article steps you through the concepts and configuration

 

https://devcentral.f5.com/articles/apm-cookbook-single-sign-on-sso-using-kerberos

 

If you -really- wanted to make a bad security decision, you could use an iRule to check for an OSX/Ipad user-agent header, and set the Kerberos header.