For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

dp_119903's avatar
dp_119903
Icon for Cirrostratus rankCirrostratus
Sep 15, 2015

Non local kerberos realm

I have kerberos for server-side (SSO) working just fine.   My kerberos sso config looks like this: username source: session.sso.token.last.username username realm source: session.logon.last.domain...
BIG-IP Access Policy Manager (APM)
security
Kevin_Stewart's avatar
Kevin_Stewart
Icon for Employee rankEmployee
Sep 22, 2015

I am being told that it is a two way non-transitive trust with domain wide auth.

 

I was afraid of that. The base requirement for APM Kerberos SSO is a forest or two-way transitive trust. A selective trust can also work, but requires more configuration in the domain. APM Kerberos SSO performs Kerberos Constrained Delegation and Kerberos Protocol Transition. The latter is what requires the trust.