For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Kevin_Stewart's avatar
Kevin_Stewart
Icon for Employee rankEmployee
Dec 25, 2013

Thomas, the two things that I usually do first when I run into trouble with Kerberos SSO are:

 

  1. Attempt to access this Kerberos resource from another machine in the domain. This will tell you definitely whether or not the app is correctly configured for Kerberos. If it doesn't work here, it isn't going to work in APM.

     

  2. Install Wireshark on your domain controller and watch the Kerberos traffic from there. This is where you'll get the best vantage point. You can also technically run tcpdump on the LTM and export a capture file to Wireshark. This tool will let you see inside the Kerberos payload, and most importantly, where the errors are.

     

If you can perform these 2 steps and report back what you find, that may help to better understand the problem.

 

Related Content