For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

dp_119903's avatar
dp_119903
Icon for Cirrostratus rankCirrostratus
Sep 15, 2015

Non local kerberos realm

I have kerberos for server-side (SSO) working just fine.   My kerberos sso config looks like this: username source: session.sso.token.last.username username realm source: session.logon.last.domain...
BIG-IP Access Policy Manager (APM)
security
Kevin_Stewart's avatar
Kevin_Stewart
Icon for Employee rankEmployee
Oct 01, 2015

So it seems to me, at least, that forest level trust may in fact be a requirement.

 

Selective trust does work, but as you've seen in the article requires some heavy lifting in the AD. The basic requirement is a forest trust or a full two-way transitive external trust.