Replace Microsoft NLB with BIGIP 2200S

Client side Kerberos will produce a single (useful) session variable: session.logon.last.username, which will be in UPN format. Example:

[email protected]    

Kerberos SSO requires two input session variables: session.sso.token.last.username and session.logon.last.domain. That means in order to do client side and server side Kerberos together, you need a variable assignment in your access policy that splits the incoming UPN into separate username and domain values. So something like this:

session.sso.token.last.username = return [lindex [split [mcget {session.logon.last.username}] "@"] 0]    

session.logon.last.domain = return [lindex [split [mcget {session.logon.last.username}] "@"] 1]