Single-Sign-On mit Kerberos Constrained Delegation

Hallo liebe Leser, als heutiges Thema möchte ich über ein weiteres Single-Sign-On Verfahren sprechen: Kerberos Constrained Delegation. Was bedeutet das? Nun was hier passiert, ist dass der User...
Published Feb 25, 2013
Version 1.0
germany
industry
microsoft
Sven_Mueller's avatar
Ret. Employee
I´m a Security Solution Architect in EMEA, focused on Application and Network-Security. I act as a liaison between customers, the F5 sales team and the F5 product teams, providing a hands-on real-world perspective. Before I joined F5, I was a Security Consultant and active on HoneyNet research topics. I hold a diploma in Electrical Engineering. Beside my IT Security interests,I love driving on the Nuerburgring (Green Hell).
View Profile
Sven_Mueller's avatar
Ret. Employee
I´m a Security Solution Architect in EMEA, focused on Application and Network-Security. I act as a liaison between customers, the F5 sales team and the F5 product teams, providing a hands-on real-world perspective. Before I joined F5, I was a Security Consultant and active on HoneyNet research topics. I hold a diploma in Electrical Engineering. Beside my IT Security interests,I love driving on the Nuerburgring (Green Hell).
View Profile
Alexander_01_13's avatar
Alexander_01_13
Icon for Nimbostratus rankNimbostratus
May 27, 2014
Hallo,

 

 

vielen Dank für den Artikel!

 

Sie schreiben: "Wichtig bei dem Thema Kerberos ist, dass man alle DNS Einträge richtig gesetzt hat. Hier bitte alle Adressen und Namen die in dem Zusammenhang verwendet werden in beide Richtungen auflösen. Das kann einem so manches Debugging ersparen."

 

 

Hintergrund ist, dass die Authentifizierung fehl schlägt und folgende Meldungen im APM-Log erscheinen. Liegt es am DNS?

 

 

Danke und Grüße

 

Alexander Weber

 

 

May 27 09:27:49 F5BIGIP03 debug websso.0[13809]: 014d0001:7: S4U ======> - NO cached S4U2Proxy ticket for user: user@DOMAIN.DE server: HTTP/exmbx01.domain.de@PTA.DE - trying to fetch

 

May 27 09:27:49 F5BIGIP03 debug websso.0[13809]: 014d0001:7: S4U ======> - NO cached S4U2Self ticket for user: user@DOMAIN.DE - trying to fetch

 

May 27 09:27:49 F5BIGIP03 err websso.0[13809]: 014d0005:3: Kerberos: can't get S4U2Self ticket for user user@DOMAIN.DE - Server not found in Kerberos database (-1765328377)

 

May 27 09:27:49 F5BIGIP03 err websso.0[13809]: 014d0024:3: 340988ec: Kerberos: Failed to get ticket for user user@DOMAIN.DE

 

May 27 09:27:49 F5BIGIP03 err websso.0[13809]: 014d0048:3: 340988ec: failure occurred when processing the work item