SSO/ KERBEROS DELEGATION

You're actually talking about two different things here, which is a common misconception. APM performs Kerberos in a proxy environment, in which case client side Kerberos (client to APM) is COMPLETELY separate and distinct from server side Kerberos (APM to server). Client side Kerberos is generally referred to as a AAA function, and entails the creation of a keytab; while server side Kerberos is generally referred to as an SSO function, and does not require the creation of a keytab. As with any AAA function, successful client side Kerberos authentication produces a set of session values that can be used with other authentication and authorization functions. And as with any SSO function, Kerberos server side authentication requires a set of inputs (specifically a user name and a domain name). Where you get the inputs to server side Kerberos is somewhat arbitrary. So in order to use client side and server side Kerberos together, you'd use the output from the AAA (a username and domain) as input to the server side Kerberos. But more important, also understand that SPNs will also be different. The SPN created in the keytab for AAA will be the SPN the client will use to request a ticket (the VIP FQDN). The SPNs used on the server side will be the SPNs of the individual servers (which the client wouldn't know about).