F5 is upgrading its customer support chat feature on My.F5.com. Chat support will be unavailable from 6am-10am PST on 1/20/26. Refer to K000159584 for details.

Forum Discussion

eric_haupt1's avatar
eric_haupt1
Icon for Nimbostratus rankNimbostratus
Oct 04, 2018

APM KCD SSO - Requesting ticket can't get forwardable tickets (-1765328163) but works eventually

I'm running into this well known KCD SSO error. I have APM performing the necessary SSO variable definitions using LDAP queries which map certificate IDs (Domain userPrincipalName) to sAMAccountNames...
application delivery
BIG-IP Access Policy Manager (APM)
action_-_322447's avatar
action_-_322447
Icon for Nimbostratus rankNimbostratus
Oct 11, 2018

Just my 2c, might not be relevant to your situation.

 

I experienced something similar when I was trying to set up an office online server and attach it to our SharePoint VIP with smart card auth. Turns out I didn't need to mess with SPNs/configure Kerberos or anything. SharePoint ACLs were handling the access to the files and the IIS site used anonymous authentication.

 

Kevin_Stewart's avatar
Kevin_Stewart
Icon for Employee rankEmployee
Oct 29, 2018

There won't be any trust between these domains

 

I'm confused now. The trust I'm referring to would be between whatever domain the target server is in, and whatever domain the users are in. You absolutely MUST have a two-way transitive trust between these domains to enable cross-domain access through APM Kerberos SSO.

 

And if this is a multi-domain environment, you should use full SPN values everywhere to remove any ambiguity. Yes, the APM SSO account is specific to this domain, but you should still refer to it by its full SPN name (not a short name).