This message was deleted.

firewall log do not show any traffic on kerberos ports. spn is set to http/aaa.domain.tld and host/aaa.domain.tld - klist shows me an right kerberos ticket

A packet trace will tell you what's happening during the auth negotiation with the back end server

have you checked the kerberos log: cat /tmp/nskrb.debug ?

@Martin Meier no entries

sounds like a binding issue / that it not even get triggered?

no definitly triggered.

have you tried to use the keytab file on cli manualy? let me search the support article...

yes kinit no problem

interesting, what counters get hit when failing using nFactor? nsconmsg -d stats | grep -i kcd

no one

any client / adc / server time mismatch ?

when i directly bind the nego pol to the gateway vserver, without aaa server, than nothin happens... just got an login form

You can try enabling debug level logging for AAA. It should nowadays log all kerberos stuff in the ns.log. Network trace should confirm that: • ADC is first responding with 401 Negotiate • Client sending same request again with negotiate and a kerberos ticket. • If above fails it might be SPN related or client not able to get a ticket from KDC • ADC I believe will use DNS SRV lookups to get the KDC so that might be an issue.

which srv lookups you mean?

I've done some research by simultaneously running cat with the nskrb.debug log and then in another session: /netscaler/nskrb kinit user@domain.dom

kinit works fine, stats do not change.... we use an alternate upn, maybe thats the prob?

so you get a TGT using kinit which is written to /tmp/krb5cc_0 if doing manual on cli but no auth if using aaa/nfactor? is the policy hit visible using nsconmsg -d current -g _hits ?

When you say alternate UPN, you mean something like the UPN is eg user@domain1.com but the AD is domain2.com?

@Daniel Marsh right

internal or external clients?

internal

I vaguely remember something about having to rewrite the username in that situation, as kerberos realm will be domain1 therefore kerberos login needs to be username@domain1, not username@domain2 It was some time ago that I did this, so I could be wrong

ok, first tried an account with the real realm... neither work

but all this should be visible in the nskrb.debug 🤔

@Martin Meier maybe i have to add anything?