Kerberos decryption failure due to SPN and service account mismatch in Edge SWG
Article ID: 453878
Updated On:
Products
Issue/Introduction
When accessing websites via an explicit proxy configured for Kerberos authentication, users may receive an "Appliance Error" or observe the proxy returning a 200 OK status for a CONNECT request followed by an internal error. This often results in a decryption failure (KRB5_BAD_ENCTYPE). This article explains the intended proxy behavior in this scenario and provides steps to correct the Active Directory SPN configuration.
Environment
- Edge SWG (ProxySG)
- IWA Direct / Kerberos Authentication
Cause
This issue occurs when the Service Principal Name (SPN) used by the client is registered in Active Directory under a different service account than the one configured in the proxy's IWA realm. When the proxy attempts to decrypt the Kerberos ticket using its keytab, it encounters a decryption failure.
Resolution
The proxy’s behavior of returning a 200 OK response followed by an exception page is intended. A 407 (Proxy Authentication Required) status code is not issued in this scenario because it would prompt the browser to immediately re-authenticate with the same incorrect credentials, triggering an infinite authentication loop. Instead, the proxy returns a 200 OK and an SSL tunnel exception page to indicate a configuration error that requires administrator intervention.
- Verify SPN Registration: Run the following command on a Domain Controller to view SPNs registered to the service account:
setspn -L [service_account_name] - Align SPN with Proxy Configuration: Ensure the SPN matches the service account configured in the IWA realm on the Edge SWG appliance.
- Clear Cached Tickets: On the client machine, run the following command in an administrative Command Prompt to clear cached Kerberos tickets:
klist purge - Test Access: Attempt to access the website again to verify that the decryption error is resolved.
Additional Information
For details on Kerberos troubleshooting, see How does Kerberos authentication work with the ProxySG and BCAAA.
Feedback
