F5 is upgrading its customer support chat feature on My.F5.com. Chat support will be unavailable from 6am-10am PST on 1/20/26. Refer to K000159584 for details.

Forum Discussion

eric_haupt1's avatar
eric_haupt1
Icon for Nimbostratus rankNimbostratus
Oct 04, 2018

APM KCD SSO - Requesting ticket can't get forwardable tickets (-1765328163) but works eventually

I'm running into this well known KCD SSO error. I have APM performing the necessary SSO variable definitions using LDAP queries which map certificate IDs (Domain userPrincipalName) to sAMAccountNames...
application delivery
BIG-IP Access Policy Manager (APM)
action_-_322447's avatar
action_-_322447
Icon for Nimbostratus rankNimbostratus
Oct 11, 2018

Just my 2c, might not be relevant to your situation.

 

I experienced something similar when I was trying to set up an office online server and attach it to our SharePoint VIP with smart card auth. Turns out I didn't need to mess with SPNs/configure Kerberos or anything. SharePoint ACLs were handling the access to the files and the IIS site used anonymous authentication.

 

eric_haupt1's avatar
eric_haupt1
Icon for Nimbostratus rankNimbostratus
Nov 20, 2018

I stood up an i2800 on TMOS 13.1.1.2 configured just for this domain and application. Same indications so it appears Kerberos within this domain either has issues or has a configuration outside the bounds of F5's recommended KCD logic. Every application I configured on F5 in my primary domain works without issue for Kerberos. I was kind of hoping something pointed to F5 under my control, but it appears to be domain specific or related to a configuration attribute outside of the baseline for KCD SSO. Frustrating.... I hate this application.