Forum Discussion
eric_haupt1
Nimbostratus
NimbostratusAPM KCD SSO - Requesting ticket can't get forwardable tickets (-1765328163) but works eventually
I'm running into this well known KCD SSO error. I have APM performing the necessary SSO variable definitions using LDAP queries which map certificate IDs (Domain userPrincipalName) to sAMAccountNames...
action_-_322447Nimbostratus
NimbostratusJust my 2c, might not be relevant to your situation.
I experienced something similar when I was trying to set up an office online server and attach it to our SharePoint VIP with smart card auth. Turns out I didn't need to mess with SPNs/configure Kerberos or anything. SharePoint ACLs were handling the access to the files and the IIS site used anonymous authentication.
Kevin_Stewart
Employee
EmployeeNow it's all starting to come together. ;)
So a few additional questions,
- Is it still producing the original error, or has it changed (working after the 3rd attempt)?
- When it works, do you actually see good APM logs to indicate it worked ("S4U == OK!")?
- In APM-to-KDC captures, do you see any differences between the Kerberos traffic of good and bad tests?
- Is there more than one server, and does it work consistently with one but not another?
- Is there more than one KDC, and have you looked to see if APM is talking to more than one of them between tests?
- Have you set the APM SSO account to use the full SPN syntax, vs. short name?
- Have you tried the KRB5_TRACE option detailed above?
- And just in case you've stumbled on a bug, have you opened a support case?
