Forum Discussion

FI_2016_187929's avatar
FI_2016_187929
Icon for Nimbostratus rankNimbostratus
Apr 21, 2015

Multiple Kerberos Authentications in APM

Hi, we have multiple subdomains that we want to have access the same application and would like them to authenticate through the F5 using Kerberos. We currently have the following Access Policy configured. Any suggestions on how we can add an additional Kerberos Auth? I have to verify, but the different domains could have a different IP range, so we could create a different branch assigned by IP address. Would that be the most efficent way of configuring? Is there any other options for multiple Kerberos auth?

 

APM
kerberos
security

2 Replies

Sort By
  • FI_2016_187929's avatar
    FI_2016_187929
    Icon for Nimbostratus rankNimbostratus
    Jun 17, 2016

    The documentation for Kerberos Authentication with End-User Logons https://support.f5.com/kb/en-us/products/big-ip_apm/manuals/product/apm-authentication-single-sign-on-11-6-0/9.html states that "You can achieve multi-domain support for Kerberos authentication through multiple virtual servers. Each virtual server must have its own access policy and its own Kerberos configuration."

     

    Does that mean it would not be possible to merge a keytab file? We have clients from multiple domains accessing F5 as an IdP with Kerberos authentication, so we cannot use multiple virtual servers.

     

    • FI_2016_187929's avatar
      FI_2016_187929
      Icon for Nimbostratus rankNimbostratus
      Aug 31, 2016

      Just following up. Would it be possible to merge keytab files from multiple domains for End-User Logons? Or is the only option be multiple Virtual Servers with its own access policy?