Forum Discussion

Doug_Pruiett_24's avatar
Doug_Pruiett_24
Icon for Nimbostratus rankNimbostratus
Feb 08, 2016

Multiple Windows Authentication Prompts after F5 Authentication

I am not the principle engineer on this issue, nor an F5 expert. I am part of a project that uses F5 and doing a little research to see if I can find help for an issue we are having.   The desire...
Secure Web Gateway
security
Michael_Jenkins's avatar
Michael_Jenkins
Icon for Cirrostratus rankCirrostratus
Feb 09, 2016

Thanks @Kevin,

After what you just said I tested something, just to see if it would work.

With the SSO profile set to the default SPN, APM tries to feth S4UProxy ticket for the user and server = http/ssrs.example.com@INTERNAL.LOCAL and I never see the 

S4U ======> OK!
.

However, if I update the SPN to user one of the servers instead (http/server1.internal.local) then it works and I see everything inspect in the logs. This seems to work on any of the pool members (not just server1).

So for some reason using ssrs.example.com doesn't work, but manually specifying an spn for one of the servers does... Does that make any sense to you? Trying to figure out why it would fail. (The service account running SSRS has the SPN associated with it for HTTP/ssrs.example.com and HTTP/server1.example.com and the other pool members). Does that account need Delegation specified on it?

Thanks for you help!