Forum Discussion

MS's avatar
MS
Icon for Nimbostratus rankNimbostratus
Mar 06, 2014

Kerberos: can't get TGT for HOST/abc@abc.com - Realm not local to KDC

Hi There,   I am trying to get the Kerberos constrained delegation to work, where the client authentication is done via certficate with the BIGIP. The BIGIP uses the further via Kerberos SSO to au...
BIG-IP Access Policy Manager (APM)
deployment
security
Kevin_Stewart's avatar
Kevin_Stewart
Icon for Employee rankEmployee
Mar 07, 2014

If this is for a Microsoft product, you'll likely want to keep authorization set to Always. So where does it fail? The S4U -> OK would suggests that APM is successfully retrieving a ticket, so is it possible that the app is rejecting it? WireShark will show you which Kerberos message is failing.