Kerberos is not working on Mobile
Article ID: 141268
Updated On:
Products
Issue/Introduction
We're running a Web Agent, and when user tries from mobile device to
access a resource protected with Kerberos Authentication Scheme, then
the authentication fails and the Web Agent reports an error to get the
kerberos token from the browser :
[11/18/2019][02:13:22][6348][6420][SmKCC.cpp:226][SmKcc::getKerberosToken]
[00000000000000000000000091ca130a-18cc-5dd26ec2-1914-02f93ac0][*10.0.0.1]
[][orsissopfs01][/myapp/myresource.asp][][Failed
to get authorization header from context]
[11/18/2019][02:13:22][6348][6420][SmKCC.cpp:119][SmKcc::getCredentials]
[00000000000000000000000091ca130a-18cc-5dd26ec2-1914-02f93ac0][*10.0.0.1]
[][orsissopfs01][/myapp/myresource.asp][][Failed
to obtain kerberos token]
How can we fix that ?
Environment
Release : 12.8
Component : SITEMINDER -POLICY SERVER
Resolution
As you run Android, it needs a third party authenticator :
Chrome on Android supports Kerberos with a third party authenticator.
See:
Writing a SPNEGO Authenticator for Chrome on Android
https://www.chromium.org/developers/design-documents/http-authentication/writing-a-spnego-authenticator-for-chrome-on-android
and
Kerberos Authenticator
https://github.com/google/android-kerberos-authenticator
For IOS, it seems you need to create a Configuration Profile to be
installed on the devices and be configured in particular way :
Kerberos Single Sign-On in iOS
https://samuelyates.wordpress.com/2013/10/11/kerberos-single-sign-on-in-ios-7/
Mobile Single Sign On from iOS 7 to SAP NetWeaver
https://blogs.sap.com/2013/09/18/mobile-single-sign-on-from-ios-7-to-sap-netweaver/
Configuration Profile Reference
https://developer.apple.com/library/ios/featuredarticles/iPhoneConfigurationProfileRef/Introduction/Introduction.html
Feedback
