Unable to Extract KerberosEncData from compressed kerberos token (CA API Gateway)

Products

• CA API Gateway

Issue/Introduction

• When use "Require Windows Integrated Authentication Credentials" Assertion along with the Authorization Context Variables  "kerberos.data.authorizations.0.pac.logoninfo.user.name" to extract the user name from the kerberos ticket, it's empty.
• After enable kerberos debug, it shows,

         STDOUT: >>> KrbApReq: authenticate succeed.

• No other error in ssg log.
• After change the log level to FINE, it shows following error,

         "Unable to extract kerberos authorization data from the kerberos ticket: Malformed PAC logon info."


To enable kerberos debug, refer to,
Enable Kerberos debug on CA APIM layer7 gateway

To change log level, refer to product document, (change both log.level cluster-wide property, and the threshold of the ssg log sink)
Gateway Logging Levels and Thresholds

Environment

Release : All supported gateway versions

Component : Integration with APM

Cause

The gateway currently doesn't support compressed kerberos token, but from windows server 2012, Kerberos Token compression is enabled by default.

Resolution

Turn off kerberos compression on KDC, the solution is on MS website: Resource SID Compression in Windows Server 2012 may cause Authorization problems on devices that don't support Resource SID compression

Additional Information

Malformed PAC logon info on new KerberosToken

Enable Kerberos debug on CA APIM layer7 gateway