Skip to main content
AtiT
AtiT
New Member
September 5, 2018
Question

Kerberos Constrained Delegation

  • September 5, 2018
  • 1 reply
  • 3475 views

Hello,

I have a request from customer to set up SSO via SAML + Kerberos Constrained Delegation. SAML is working but I have problem with the kerberos delegation. The backend server is IIS on Windows 2016 server.

I set everything I found in the admin guide for Fortiweb - KDC server, the SPN's, the account and delegation,  application pool in IIS and changed on IIS the useAppPoolCredentials to True + use the service account.

 

However it seems to me that the fortiweb does not communicate with the KDC. There is no packet sent to KDC to obtain a kerberos ticket on behalf of the user.

 

Does anyone have an idea where the problem should be? Or maybe a bug?

Fortiweb VM is used with firmware version: FortiWeb-VM 6.01,build0036,180822

1 reply

lokem
lokem
New Member
September 18, 2018

What I found in getting Kerberos to work in FortiWeb is making sure the "Delegated HTTP Service Principal Name" is absolutely correct with case sensitivity. The domain portion should be in upper case.

I think FortiWeb itself passes the packets to IIS so the KDC communication is still from IIS.

Terms & ConditionsAccessibility statement
Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!