Alexander_Poly1
Dec 20, 2018Altocumulus
APM Kerberos AUTH with strong encryption algorithm (AES) support.
Hello,
Tell me please which version of BIGIP support AES256 in keytab for Kerb Auth?
In my Enviroment (Win2012+BIGIPv13) I can use only rc4-arcfour-hmac in keytab (as described in manual https://support.f5.com/kb/en-us/products/big-ip_apm/manuals/product/apm-authentication-single-sign-on-11-5-0/9.html). But, if I generate a key with the AES256 encryption, then the authentication does not work and the following errors occur:
**...modules/Authentication/Kerberos/KerberosAuthModule.cpp: 'display_status_1()': 94: 7bc9dd3a : GSS-API error gss_accept_sec_context: d0000 : Unspecified GSS failure. Minor code may provide more information ...modules/Authentication/Kerberos/KerberosAuthModule.cpp: 'display_status_1()': 94: 7bc9dd3a : GSS-API error gss_accept_sec_context: 186a5 :**
As I understand, changing the config (/etc/krb5.conf) manually is not supported (as each APM Policy update or restart apmd service overwrites the config).