401 unauthorised error message when using Kerberos
Information
| Summary: |
401 unauthorised error message when using Kerberos |
| Environment: |
Product: LoadMaster Version: Any Platform: Any Application: Any |
| Question/Problem Description: |
What does it mean to receive a 401 unauthorised error message in the web browser when using Kerberos Constrained Delegation ESP on the LoadMaster? |
| Steps to Reproduce: | |
| Error Message: | 401 Unauthorised |
| Defect Number: | |
| Enhancement Number: | |
| Cause: | The Kerberos authentication to the server has failed. |
| Resolution: |
It is possible to enable SSO debug logs on the LoadMaster to observe if the Kerberos ticket is being generated successfully. This article outlines how to enable these SSO debug logs and how to interpret them. It is also possible to perform a TCP Dump (Packet Capture) using the LoadMaster to check if the Kerberos authentication flow is happening correctly. If it is observed that the Kerberos ticket is being generated successfully via the logs and/or the TCP Dump on the LoadMaster, then the 401 unauthorised error message is being generated by the server. It would be recommended to check the server logs to confirm that the Kerberos ticket is being accepted when authentication is being performed or to consult the server vendor to confirm the Kerberos authentication settings have been set correctly. |
| Workaround: | |
| Notes: |
How to troubleshoot Kerberos Constrained Delegation ESP with an SSO Debug trace: Performing a TCP Dump: https://support.kemptechnologies.com/hc/en-us/articles/360030802632-Performing-a-TCPDump Kerberos Constrained Delegation: |