APM Cookbook: Single Sign On (SSO) using Kerberos

To get the APM Cookbook series moving along, I’ve decided to help out by documenting the common APM solutions I help customers and partners with on a regular basis. Kerberos SSO is nothing new, bu...
Published Apr 28, 2014
Version 1.0
BIG-IP Access Policy Manager (APM)
cookbook
kerberos
microsoft
security
SSO
Smithy's avatar
Smithy
Icon for Cirrostratus rankCirrostratus
Aug 25, 2017

Sounds like you need to set the "SPN Pattern" on the Kerberos SSO configuration. From the APM help page:

 

  • HTTP/%h@REALM with REALM replaced by the actual realm name as specified in the Kerberos Realm field. The %h option takes the hostname from the HTTP request Host header. For example, from this header, Host: , %h is replaced with . The %h option is useful for multi-homed web servers (when multiple hosts use a single IP address) to avoid issues with DNS reverse lookup.
  • HTTP/%s@REALM with REALM replaced by the actual realm name as specified in the Kerberos Realm field. The %s option takes the hostname discovered through reverse DNS lookup using the server IP address.

Also have a look at: https://devcentral.f5.com/s/feed/0D51T00006i7ZhkSAE