Forum Discussion

Kay_Ingerfeld's avatar
Kay_Ingerfeld
Icon for Nimbostratus rankNimbostratus
Oct 09, 2019

Kerberos double hop working with APM?

We are currently using a full webtop with a link to a web page that gives users access to their home directory. This requires a new authentication (at the moment NTLM). We would like to use SSO via Kerberos.

 

The communication is as follows: APM logon page -> webtop -> Link to website -> WebApp to file server via cifs and user´s credetials

 

APM OS is 14.1.2, the Webserver is MS Server 2012R2 with IIS 8 and the file server MS Server 2012R2, too.

 

I created a kerberos sso object in apm with dedicated user and spn as listed here:

 

Username Source         session.sso.token.last.username

User Realm Source      session.logon.last.domain

 

Kerberos Realm         DOMAIN.LOCAL

KDC

UPN (disabled)

 

Account Name         host/apm-kcd.domain.local

SPN Pattern            HTTP/fileshare.domain.local@DOMAIN.LOCAL

 

Send Auth on 401

 

User account in AD:

 

 

 

 

ServicePrincipalName host/apm-kcd.domain.local

UserPrincipalName host/apm-kcd.domain.local@DOMAIN.LOCAL

 

No error in log but it´s not working...

 

...

92ecf879:S4U ======> - we have cached S4U2Proxy ticket for user: itsme@DOMAIN.LOCAL server: HTTP/fileshare.domain.local@DOMAIN.LOCAL

92ecf879:S4U ======> OK!

92ecf879:GSSAPI: Server: HTTP/fileshare.domain.local@DOMAIN.LOCAL, User: itsme@DOMAIN.LOCAL

92ecf879:GSSAPI Init_sec_context returned code 0

92ecf879:GSSAPI token of length 1889 bytes will be sent back

...

 

I do not know if the double hop ever works in APM or if it is the target webapp.

 

Any ideas?

 

Thanks & best regards,

Kay

BIG-IP Access Policy Manager (APM)
security

5 Replies

Sort By
  • Dave_W's avatar
    Dave_W
    Icon for Employee rankEmployee
    Oct 09, 2019

    Hello Kay, is the link to the server a Webtop Link or something else?

  • Shawn_Conway's avatar
    Shawn_Conway
    Icon for Cirrus rankCirrus
    Oct 09, 2019

    Hey Kay, we use authentication-kerberos using a configured keytab file to accomplish this and add it to the rule as your authentication

  • JoshBecigneul's avatar
    JoshBecigneul
    Icon for MVP rankMVP
    Oct 10, 2019

    Make sure to troubleshoot each half of a Kerberos setup separately. Is Kerberos AAA working in this case?

     

    I had to dig up my notes on this as it has been a while, but essentially Kerberos SSO needs the following things first:

    • successful sign-on to the target application inside the domain from other systems (target app SPN must already exist and be functional),
    • working forward/reverse DNS on the BIG-IP (ie using Active Directory for DNS resolution),
    • Connectivity to the KDC (looks like you have this),
    • NTP must be functional.

     

    In the Delegation tab for the F5 SSO user in AD, ensure that "Trust this user for delegation to specified services only; Use any authentication procotol" is selected.

    In the service account for the target application, I found that I needed to set up a delegation to the app's own SPN records with the Delegation setting set to "Trust this user for delegation to specified services only; Use Kerberos only." The F5 SSO user and the target application user should be separate.

     

    I'm not an expert on this stuff, but it has worked for us in the past and is still in production use.

     

    A pretty good troubleshooting resource is here by Cody Green.

     

    Microsoft has an in-depth description of the concepts here.

  • Kay_Ingerfeld's avatar
    Kay_Ingerfeld
    Icon for Nimbostratus rankNimbostratus
    Oct 10, 2019

    Hi, thanks for all the reply!

     

    Now to the answers:

    • Yes, we use the standard webtop link
    • OK, we did not test the complete keytab Kerberos config yet
    • Other Kerberos-Auth configs without double hop (in the same AD) do work without any problems

     

    I will try the keytab stuff next...

     

    Thank you again,

    Kay

  • Dave_W's avatar
    Dave_W
    Icon for Employee rankEmployee
    Oct 10, 2019

    Hello Kay, so when say Webtop link I mean a specific type of object (those a direct links). That said SSO is not supported with Webtop Links.