http connection problems with kerberos authentication using Cisco ACE

helsayed78 — Mon, 02 Jul 2012 14:43:32 GMT

Does anyone know how this problem can be solved?

Regards,

Hesham

http connection problems with kerberos authentication using Cisc

sesoerensen — Tue, 17 Jul 2012 00:47:39 GMT

Hesham,

Easy fix

Create a HTTP parameter map, and assign it to the class in the service-policy.

parameter-map type http HTTP

case-insensitive

persistence-rebalance

set header-maxparse-length 65535

set content-maxparse-length 65535

length-exceed continue

policy-map multi SLB

class VIP

poli ..

load ..

blah blah

appl-parameter http advanced-options HTTP

Basically, this is what happens:

The kerberos ticket is too big to fit in the HTTP header. Thats, it's to big for ACE, which caps the header size at 4K by default.

Try before you buy test:

Create an user within Active Directory, and only assign it to the bare minimum of security groups.

Then try accessing the website, before applying the configuration.

Cheers mate,

Søren Elleby Sørensen